Admin-facing screens are exposed in the frontend but enforced by Keycloak roles, Kong policy, and admin-service checks.