How this is built

The stack, how the parts fit together, and how access is controlled — in plain English.

Access is granted, never assumed

One AIU sign-in works across the whole suite. There is no separate account for this app, and no second password to hand out.
Access is granted per person. Without that grant the app does not open at all — not an empty version of it, not a header with nothing under it.
Every table carries its own access rules, so the rule lives with the data rather than only in the screen that happens to read it.
The tables behind the six services are not reachable from a browser at all. Only the server-side layer touches them, and only after it has checked who is asking.
Every request checks the session and the grant again inside the handler, not only on the way in.

Open Activity and switch to the audit view to read it.

Saving a visit, approving or dismissing something in the queue, putting an outreach draft in front of someone, ticking a to-do, and rebuilding the sample company each append a line: what was done, who pressed it, and which rep it was done for. Those last two are kept as two separate facts, so an action taken on someone’s behalf can still be traced to the person who actually took it.
That list is the list, and two saves are missing from it today: adding a contact, and turning a quote into an order on the orders screen. Both write their record and neither writes a line — though that same order approved from the queue does. The audit view shows what is actually in the log, never what ought to be in it.
Lines can be added. No line can be edited or deleted — not by a rep, not by an administrator, and not by this app. That rule is held by the database itself, which is what makes it a property of the system rather than a promise about our code being careful.
Demonstrated rather than asserted: using the most privileged credential we hold — the one that is allowed to ignore every other access rule — we tried to alter a line that had already been written. The database refused it outright, with a permission error naming the log as append-only.
Putting the sample company back does not empty it either. A restore writes its own line into the one record it cannot erase, so “this was reset” is part of the history rather than a gap in it.