Four people, three roles, enforced by the database

Four people share three roles: Rowan is the Practice Administrator, Teresa and Renee are practice managers (Renee for one region, as the next step shows), and Glen is the office viewer.

As Glen, draft runs vanish and variance notes show as restricted. In database mode that is not the screen hiding things: the policies in Postgres never return those rows to his account.

Every role’s allowed and blocked reads and writes are proven by automated tests against a real Postgres database, including the Practice Administrator being unable to edit a published run or the audit trail.