Access scoped to the work
Each person and each agent gets access based on role and purpose. Reaching one customer, workflow, or data type does not imply reaching the rest of the company. Default deny: if no rule allows it, the request is refused, and the refusal is recorded.