The visibility model

Acculio’s defining idea is record-level billing privacy. It shapes every screen, so it’s worth understanding once.

What each role sees

• A timekeeper sees only the matters they’re assigned to and only their own time and expense entries. Rates and amounts are not shown — not even on their own work.
• An admin (owner or billing admin) sees every entry across the firm, with rates, amounts, and reports.

The same time entry looks different depending on who’s asking. A timekeeper sees 1.5h. An admin sees 1.5h · $300/hr · $450.00.

Why it’s safe

This isn’t a CSS trick. Visibility is enforced in two places below the UI:

1. Row-level security in Postgres. Every query runs as a low-privilege role that can only read rows its policies allow. The application cannot bypass it.
2. Redaction in the API. Rate and amount fields are removed from API responses for anyone without billing access.

By the time data reaches the browser, the sensitive fields are already gone for people who shouldn’t see them. The frontend simply renders what the API returns — so there’s nothing to leak client-side.

Granting broader access

Visibility is deliberate, not all-or-nothing:

• Matter assignments decide who can work on a matter.
• A full-visibility grant lets a specific person see all entries on a matter, for supervising partners or billing staff.

When embedded

If Acculio is embedded inside your case-management app, the model is unchanged: attribution resolves to the acting user, and the same row-level security and redaction apply. The embedded UI renders exactly what the API returns, just like the standalone app.