Sample rows removed. Committee-scoped projections via CASA_API.commadmin. No broad member PII, secrets, or finance-ledger access.

Membership uses relation documents. Office-bearer terms cannot overlap. Attendance scans are idempotent. Committee Admin sees masked member projections only — no religious/photo cells. Archival blocks new activity but preserves evidence.

UI controls are hints only. Authorization is server-enforced via accessGrants, geography, purpose, MFA and SOD. Super Admin does not auto-receive sensitive.read. Permission-denied responses omit resource existence details.