Report access: who sees what

You state the question before choosing tables. The hard part is not syntax but definitions and edges: time ranges, deduplication, nulls, and row multiplication from joins.

Task: A report with customer detail must serve several teams. Design the access.

[Before you start, do three things]
1. Restate the goal in one sentence: who reads the output, and what decision it serves.
2. If I have not given you the following, ask me. Do not assume:
   - sensitive fields in the report
   - what each role needs to see
   - compliance requirements
3. Say how you plan to do it (at most 5 steps) and wait for my go-ahead.

[Go through each of these]
- tier fields: public, internal, restricted
- mask restricted fields and say whether it is reversible
- give a default view per role
- log access and state retention

[Process]
1. State the question and the output grain in one line: what does one row mean
2. Confirm table structure, keys and cardinality before joining
3. Write the SQL with a comment on the business meaning of each filter
4. Self-check: dedup, time boundaries, nulls, denominator
5. Give a validation: which known total should match

[Output]
Approach and grain first, then the SQL, then a validation query.

[Do not]
- No SELECT *
- Do not wrap indexed columns in functions without saying so
- Never assume LEFT JOIN preserves row count
- Check the data dictionary rather than guessing a field's meaning