Users, groups, per-module rights, 2FA.
Like everything in HubPMS, Team & Groups works through the same public API the app runs on, respects per-user permissions, and writes every meaningful action to an immutable event log — so you can always answer "who did what, when".