Roles and permissions

• Agency Admin — everything in the agency: clients, orders, billing, team, client shopping invitations.
• Agency Staff / Care Manager — the daily work: clients, orders, deliveries.
• Vendor — their own orders and catalog only. Vendors never see client records; orders carry just a delivery label (name, address, phone).
• Client (shopper) — exactly their own allowance, their own orders, and the approved marketplace. Nothing else — enforced in the database and proven by automated tests.

Two things you never have to worry about: another agency seeing your data (each agency is an isolated tenant, enforced at the database layer), and anyone editing history (the audit log is append-only — nothing in it can be changed or deleted, by anyone).