Require two-factor authentication

Who: the Super Admin. Go to: Settings → Security → Require 2FA for Admins and Super Admins.

Set up 2FA (or a passkey) on your own account first. Admins and Super Admins without either are asked to set one up before they can use the workspace. Someone with a passkey who signed in with just their password is asked for one touch of it (Confirm it's you). Employees aren't affected.

Example: Priya turns it on. Next time Tom signs in with his password, Vaultime walks him through scanning a QR code before he can open Approvals.