Three separate boundaries
- Customer boundary — one customer, their own jobs, documents shared with them.
- Trade partner boundary — a subcontractor sees the jobs they are assigned to, and the operational detail those require.
- Internal boundary — costing, margin, internal notes and other customers' data never cross either line.
Why the interface is not the control
Hiding a field in a page hides it from a polite user. The data still travelled, and anything that travelled can be read. The only durable control is refusing to return the data at all unless the requester's scope allows it.
That means the scoping decision lives at the point where records are fetched: resolve who is asking, resolve what they own, return only that. Everything the page does afterwards is presentation.
Deny by default
New fields, new tables and new attachments should be invisible externally until someone deliberately exposes them. The alternative — external surfaces inheriting whatever gets added internally — guarantees that one day an internal field ships straight to a customer.
Visibility of access
- Record when external access happens so it can be reviewed.
- Store technical identifiers such as address and device details as hashes rather than raw values.
- Deduplicate repeat opens so the record stays readable rather than noisy.
- Keep the ability to revoke or expire access in the business's hands.