Explanation
The Master user is a predefined user that has complete control over the entire system and can manage a full recovery when necessary. To log in as the Master user, you need the following items:
* Master CD: This is a physical CD that contains the Private Recovery Key, which is a file named RecPrv.key. This key is used to decrypt the Vault data and authenticate the Master user. The Master CD must be inserted into the Vault server's CD drive.
* Master Password: This is a password that is set by the Master user during the initial installation of the Vault. It is used to log in to the Vault with the Master user name. The Master password can be reset by the Master user if needed.
* Console access to the Vault server: This is a direct access to the Vault server machine, either physically or remotely. The Master user can only log in from the Vault server machine, not from any other client machine.
* Private Ark Client: This is a graphical user interface that allows the Master user to connect to the Vault and perform various tasks, such as recovering orphaned safes, activating predefined users, and managing network areas. The Private Ark Client must be installed on the Vault server machine and configured to use PrivateArk authentication method.
References: How to log in as the Master user, Predefined users and groups, Log in as Master from CyberArk PrivateArk Client

Explanation
According to the CyberArk documentation1, once Object Level Access Control is enabled for a Safe, it cannot be disabled. This feature allows granular control over user access to passwords and files in the Safe, regardless of their Safe level member authorizations2. To enable Object Level Access Control, users need to have the Manage Safe authorization in the Vault1.

Explanation
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Using-Logon-Accounts-for