Like AWS — bootstrap your account once, then provision scoped IAM users for your team. Root is god-mode; use it sparingly.