Only admins can manage staff access.