Most platforms promise privacy
in a Terms of Service.
We enforce it in the database.

-- Users can only read their own mentoring data
CREATE POLICY user_isolation ON mentoring_data
  FOR SELECT USING (
    user_id = auth.uid()
  );

-- No org-side override. No org backdoor query.
-- The database rejects the request before
-- application code is involved.

FUNCTION enforce_minimum_group_size(data, group)
  IF group.member_count < MIN_CLUSTER_SIZE (8)
    RETURN null
    -- Data is hidden, not shown as zero.
    -- Leaders never know this group exists.

  RETURN aggregate(data)
  -- Only pre-computed averages and trends.
  -- Individual records never leave the table.

FUNCTION resolve_visible_scope(leader, hierarchy)
  scope = leader.position_in_hierarchy

  -- Company-wide: aggregated across all departments
  -- Department: only teams within their department
  -- Team: only their direct reports (if 8+ members)

  RETURN filter_to_scope(scope)
  -- Leaders see only what their position permits.
  -- No escalation path. No request form.