MFA is required for every Operations Hub session. Business records remain workspace-scoped by Row Level Security.