Hub access is org-scoped. Commanding equipment additionally requires the operator role and a current MFA code.