Code-based sign-in for the internal admin.
Only allowlisted emails can access admin. Unknown addresses get a polite refusal page.