adusr_…
ACTIVE and holds user-shadow:r (or is owner): may enter any workspace with its owner's read keys.
canShadowRead, and holds user-shadow:w: the owner's write keys too.
The cfx-admin Cognito sub; null before their first Cognito sign-in.
First and last name, else the email.
CFX staff as the customer and bank dashboards see them: an admin user of the
cfx-adminpool, with whatuser-shadow:r/:wlet them do there.