Start with group and venue assignments
Group isolation and assigned venue scope are the foundation of a shared reporting system. A venue manager should not gain access to another group simply by changing a filter. Test the permitted and denied paths using actual role profiles.
Separate HR records from purchasing visibility
Salary records require a different access boundary from invoices or inventory. HR users work in their HR pages; Purchasing users should not read private HR records. Admin reporting uses aggregate labour costs for permitted readers.
Validate read-only management roles
A GM can be assigned limited Admin reporting views without receiving user-management authority. Interface visibility and database permissions both need verification. Hiding a menu item alone is not sufficient access control.