PeopleContext

PeopleContext is the HR directory: employees, who they report to, compensation, personal details, and confidential notes. Each signed-in person sees a different slice. The same application is how PocketContext checks that filtered snapshots actually hide the rows they should hide.

The app includes a read-only browser reader. The command-line login redirect is the one configured for use now. The browser Google redirect is not ready yet.

Who sees which slice

flowchart TD
  emp[Employee record]
  emp --> dir[Directory<br/>any signed-in employee]
  emp --> pay[Compensation<br/>self, HR, managers above]
  emp --> personal[Personal details<br/>self and HR]
  emp --> notes[Confidential notes<br/>HR only]

Self access needs an account link. An operator sets that link, or a validated Google login creates it when the work email matches. Administrators manage links, HR roles, and reporting lines. Those three policy tables stay out of the SQL snapshot. They decide the filter. They are not rows an assistant can browse.

People read through that filtered SQL, including HR. The ordinary record-list API is closed, so a list call cannot widen what the snapshot hid. HR writes employee, pay, personal, and note records through the records API. Employees and managers use the reader and SQL.

sequenceDiagram
  participant Alice as Alice, a manager
  participant PC as PeopleContext snapshot
  participant Helen as Helen, HR

  Alice->>PC: SQL show
  PC-->>Alice: directory, own pay, and reports' pay
  Helen->>PC: SQL show
  PC-->>Helen: directory, all pay, details, and notes

Transferring someone to another manager moves whose pay you can see. The old manager keeps their own pay, and loses the transferred person's.

A filtered snapshot is rebuilt from the app's filters for the signed-in account. Managers do not get a special SQL dialect. They get a smaller database.