We have some cataloguing volunteers using Koha that we need to enable 2FA for and we do not want to force 2FA for all users. The cataloguing volunteers do not have access to patron records to view or edit to ensure data protection, however as they don't have edit_borrowers they can't amend their own account in order to set up their 2FA. Our current workaround is not ideal as we have to add edit_borrowers for volunteers but then add in some jquery to IntranetUserJS to hide the patron and circulation tiles/buttons. It would be great to see a workflow that allowed a user with only 'catalogue' permission enabled and the ability to manage two factor authentication for themselves when set as enabled or enforced.