Events, bookings and guests — for the two people who run them.
Two-factor sign-in is required for every admin.
No password reset here — if you lose access, ask the developer to reset it.