Sevulic assigns pause, recovery, upgrade, and treasury powers to different quorums. One compromised role cannot disable protections and transfer protected assets