Principles and protocols for managing marketplace user permissions safely without primary credential sharing.