Control and records

Ten roles and forty-nine permissions, and the distinctions are the ones payroll actually needs. Seeing who works here, seeing what they are paid, seeing their Social Security number and seeing where their pay is sent are four separate permissions, because they are held by four different sets of people. A manager has the first and none of the others.

Permissions are not applied by hiding buttons. Where the roster cannot show pay, the pay is not fetched from the database at all — not fetched and hidden — so there is no payload to leak into a log, a cache, or a props blob sent to the browser.

Every company’s data is isolated by a wrapper that makes it impossible to write a query without an organisation predicate, and a record belonging to another company returns "not found" rather than "forbidden", because a denial would confirm it exists.

Sensitive values are encrypted with a per-record key and bound to the record they belong to, so bytes moved into a different row fail to open rather than decrypting into somebody else’s file. Social Security numbers are stored sealed; the last four digits are a separate column so a screen can show enough to recognise somebody without ever unsealing the number.