Data modelWork date: Date unknown Aerial — connected records and permission boundaries
I keep the relationship graph, institutional source records, and permission grants distinct so a visible aggregate never implies access to every identity or document.