Protected with challenge verification, CSRF, replay protection, and rate limiting before the admin handoff.