Need better way to secure higher level access roles at the device. Four and six digit pin have been easily discovered. For those roles can we make the primary to facial recognition and the PIN only if facial has issues via 2FA to email for that role?