Context
Permissions were granted by hand and nobody could say who had access to what.
Task
Make access visible and verifiable.
Approach
An org tree, a permission matrix, audit, and a one-page 'how it works'.
Result
Any access is explainable and revocable; audit is a live screen, not a report.
