Permissions at the server. Context at every boundary.

Company Access & Permissions

Keep each operation in its authorized company context.

R354.7 endpoints check company context and role or granular permissions. Engineering edits, financial operations, job assignment and supervisor approval have separate access rules. Company subscriptions also control sign-in availability. These are source-observed controls, not a security certification or a claim that production isolation has passed a new audit.