MuseLegal locks down who can see which matter

Until now, deciding which clients, attorneys, reviewers, or paralegals could see a given matter leaned on implicit ownership and the user interface simply not showing things. MuseLegal swapped that out for an explicit assignment table - every person tied to a matter is listed, with a role attached - and then taught both the application and the database to check that list before handing anything over.

The move matters because it's defense in depth. Documents, portal messages, tasks, intake submissions, and downloadable files are all gated by the same rule, and partners and admins keep their global view. Even if a request somehow skipped the server's check, the database itself would still refuse to return another matter's contents. MuseLegal notes no automated tests ran against the change, and the PR was merged within a minute - this is groundwork being laid quickly so later work can build on it.