Four layers, not one promise.
Security here is not a single mechanism you have to trust. It is four, stacked, so a failure in any one of them does not expose anything — and the one that matters most is enforced below the application, where a developer mistake cannot reach it.
Authentication
Stops strangers getting in at all. Single sign-on is available, and every page reachable without logging in is bot-checked before any lookup runs.
Row-level security
Stops one company seeing another data, applied by the database on all 127 tables, verified by listing the live database rather than by reading a policy.
Capabilities
Stops a dispatcher opening payroll. Checked on the screen and again on the server, so hiding a button is never the only thing between someone and a money action.
A record of everything
Stops anything happening without a trace. Tracked changes are written by the database itself, recording who, when, and the value before and after.
Roles are bundles, evaluated per company.
Lanexa ships eleven role templates and thirty-nine permissions. Permission is not a property of the person, it is a property of the person in that company, so the same individual can administer one carrier in a group and be read-only in another.
The money desk is split on purpose. The clerk who enters an invoice or a carrier bill is not automatically the person who can approve, void or pay it, and a driver settlement needs a second person before it is released.
The honest weak point.
Not every screen is permission-gated, and that is a documented decision rather than an oversight. Money and privileged screens are gated; operational screens are open to any signed-in member of the company. Those screens are still company-scoped by the database and their writes are still permission-checked on the server, but telling the system that a particular dispatcher may not open Customers at all is not yet possible. It touches every module and was deferred to its own piece of work rather than half-done.