Not everyone at a fund should see everything. An analyst maintaining data rooms does not need to read internal notes or open a passport image. Permissions here are granular and enforced on the server, so the interface and the API agree about what someone may do.
Hiding a button is not access control. Every permission is checked on the server for every request, so an administrator without a capability cannot reach the underlying data by any route.
Sensitive surfaces are deliberately separated from ordinary ones. The investor roster is one thing; internal notes, identity images, subscription form responses and wire details are each gated on their own.
An operations hire can run data rooms and documents without ever seeing an investor's identity documents or your internal notes.
Viewing as an investor answers "what do they see" without giving anyone the ability to act on their behalf.
Administrative actions are recorded against the person who took them, so access and accountability match.
An administrator with no restrictions has full access. Once you assign specific capabilities, they are limited to those, and every request is checked against them on the server.
No. Acting on another administrator requires the capability for managing administrators, and nobody can delete or demote themselves, so a portal cannot be left without an administrator.
It shows an administrator the portal exactly as a specific investor sees it, for support and diligence. It is strictly read-only: every mutating request made in that mode is rejected, so it cannot be used to act as the investor.
Permissions, the audit trail and the isolation model are three parts of the same answer.