Who is allowed to do what — and how would you prove it? In goca, operators and API principals are identities. Password login returns a 12-hour JWT; every management call requires it. What an identity may do comes from six built-in roles, and the splits are deliberate: system-admin runs the platform, ca-officer runs the CAs — system administration is not trust administration. template-editor writes profiles, ra-operator decides enrollments, requestor asks, and auditor reads everything and changes nothing.
One rule is enforced at save time, not by policy prose: auditor is exclusive. An identity holding it can hold nothing else — locally and through SSO role mapping alike. An auditor who could also issue certificates would be auditing their own work.
Tokens are self-contained and signed with a key derived from the master secret, so any replica honors them — and rotating that secret invalidates every outstanding token and session at once. That is the only session kill switch, and it is total.
Now I can name the six roles and say why the auditor holds only one.