A separate access boundary
- Safeguarding has its own view and management permissions at the case’s school. Ordinary incident or risk permissions do not grant access.
- Sensitive summaries and closure outcomes use field-level encryption. If the required encryption key is unavailable, the service refuses access rather than storing plaintext.
- Case access is recorded inside the restricted domain; a general audit permission must not reveal the existence of a confidential case.