Roles

Role	Can
Viewer	browse and query through shared connections, read-only
Editor	create their own connections, edit data, run any SQL the database user may, wb shell
Admin	manage users, share connections, deactivate databases, settings, networks
Owner	everything; one per instance

Two-factor sign-in. Settings → Security turns on a code from an authenticator app (TOTP), with one-time recovery codes. Admins can require it for every admin and the owner: Settings → General → Sign-in. Whoever doesn’t have it yet is taken to set it up before anything else. To turn the requirement on, you need two-factor on your own account first.