Security
Fail closed, then explain.
If we cannot prove the adult may see this class of information for this child, we do not show it, send it or invite them.
- Grant-scoped parent queries; raw client school ids cannot select authority
- Restriction evidence expiry turns the evaluator to unknown
- Authenticated attachment gateway — no storage redirect
- Print packs go stale when authorisation revision changes
- Audit on restriction, grant, invite, merge and safeguarding actions
- Signed webhooks; mail-scanner GET cannot redeem an invite