Isolation
Every query is school-scoped. Cross-school reads deny. Merges cannot touch another school.
MATs
Maple Trust in the demo has Riverside and Oakfield. The same login can hold two parent memberships. A forged school id never changes authorisation.
Every query is school-scoped. Cross-school reads deny. Merges cannot touch another school.
Sam is a parent at both schools. Tabs keep their own context. Mutations cannot retarget the other tab.
Provision a blank school. Impersonate staff only — never a parent across households.
Trust
Navy ink, warm paper, UK schools, processor not controller. Safety is never an upsell.
Import the register, review restrictions, then invite. The evaluator is already live in the demo.