Tighter Fences Across Portals, Previews and Email Matching

A security sweep across the platform: staff-only reads require an active team membership a client-portal session can’t satisfy, the admin’s client-portal preview stays inside the portal’s own workspace, and email lookups act only on an exactly matching address.

• Uploaded attachments stay in the uploader’s own folder
• The portal preview reads billing only with billing permission
• Desktop runner records change only with an active membership