Tenancy and identity
One installation serves many institutions, and the boundary between them is enforced by the database rather than by application code. Sign-in is phone-first with a one-time code, because a phone number is the identifier most staff actually have. Roles are assigned per scope, not per person.