Access is gated by user-mappings.json.