- canView() + canViewAny() in EnforcesRoles: all SMS roles can view
- View pages for all 7 resources so viewers can open records read-only
- Custom ActivityResource restricts activity log to admin + manager only
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>