TENANCY

Org → DataRoom → Membership → Documents / Facts / Threads / Audit

• Luther / platform role sees all rooms.
• Everyone else: explicit grant only via non-revoked Membership.
• Cross-tenant object reads return 404, never 403 (avoid existence leaks).
• While Luther impersonates, access is evaluated as the target user (explicit grants).
• Guest role is view-only by default; Agent membership is room-scoped.