Who can see what

A role is not a list of buttons. It is a width.

The four widths

For each kind of record, a role can see their own, their team's, their office's, or the whole tenancy.

There is a fifth setting that is not a width: none. A role can be unable to see a kind of record at all, and that is a real state rather than an empty list.

The part that is easy to get wrong

Totals.

A weekly summary that reads every deal in the business, adds them up, and shows the total to somebody restricted to their own office does one of two harmful things. Either the total includes rows they cannot see, or the list is filtered and the total is not, in which case one subtraction recovers the hidden rows.

The second is worse than the first, and it is the more common one, because filtering a list is the obvious thing to do and filtering a total is not.

So totals here are computed from the rows the person can see, at the point the rows are gathered. There is no path that reads everything and narrows afterwards.

What proves it worked

Sign in as a restricted role. Add up the rows on a list yourself. It equals the total shown above it.

Then compare that total against the same total for somebody with a wider role. They differ, and the difference is not shown anywhere to the restricted person.

The compliance role

There is a separate role for compliance work with exclusive access to the compliance queue. Exclusive means what it says: principals and administrators do not see that queue by holding their own role. Designating an existing role as the compliance officer would hand its access to everybody who holds that role, which is the opposite of what a compliance function needs.

Changing somebody's role

Takes effect on their next request. It is recorded, with who changed it and when, in your audit trail.