John Cardinal
443d382394
Step 4 of 4712 (security review F15). Pick lists checked only the Select role, which customer contacts have for most types, and took the columns from the request, so a contact could list every customer with phones and emails. For contacts now: the customer list holds only their own customer (head office contacts: their head office's customers); the unit list only their own customer's units (head office contacts: the chosen customer, which must be theirs; none until one is chosen); unit models as before; any other list 403. pick-list/single names only those records. New CustomerPickList variant for a single customer. Staff unchanged. Checked: the contact's customer list went from 72 customers to its own one; units only its own; vendors and users 403. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>