Deployment owner only (users.role = owner) — the purge and one-off sweeps; everyone else is answered 404
users.role = owner