SSO, MFA, roles, isolation and an append-only trail — on from the first day rather than bought as a tier.