local admin credentials or two factor or the BEST is a immutable time-lock, so a snapshot cannot be deleted before the retention period that was set when it was taken expires