Security
Security and access
Role is not a permissions afterthought. It is the thing that shapes the application.
Role gates three things
Every person on staff is a first-class actor with a role, and that role decides which surfaces open, which mutations you can make, and which tools an agent will load on your behalf. The same product is a spend and efficacy console for a general manager, a work queue for an area scout, and a tendency workbench for a coordinator.
- Surfaces. A position coach does not see the cap. It is not hidden in the UI, it is not served.
- Mutations. Who can advance a prospect's state, approve a decision, or publish a plan.
- Agent tools. An agent acting for a coordinator gets roster health only. The wider wellness records are never in reach.
Restricted tables
Wellness, rehab and compliance records are restricted at the store, not filtered at the edge. An agent operating for a role without access cannot query them, so it reports that it cannot answer rather than partially answering.
Every piece of work carries its record
Owner, state, evidence, approval. Who owns it, what state it is in, what evidence backs it, and who signed off with what in front of them at the time.