How are members identified at the subaccount and space level in SAP BTP?

Why keep at least two users managed by the default identity provider in a subaccount?

What is the SAP Audit Log Viewer service used for, and what's needed to use it?

Where do the role templates in a subaccount come from?

Give an example of an application that dynamically creates new roles during operation on SAP BTP, and what triggers each new role.

What does SAP now recommend instead of SAML for subaccount trust, and why?

What does the "Allow Paid Services" switch on a space quota do?