The case file
To the same file. Not a portal with a copy of some documents in it — the actual case file, with their own seat in it. That sentence is the whole argument, and here is why it is safe to say.
Why nobody else says that
Somewhere in the application there is an if-statement deciding whether to show you a document. It is usually right. It is right in the page it was written for, and in the three pages written after it, and then somebody adds a report, or an export, or a search, and the if-statement is not in that one.
Nothing about that is incompetence — it is the shape of the problem. A rule enforced in the place where things get displayed has to be repeated in every place where things get displayed, and the count of those places only ever goes up.
Measured on the live system, 19 August 2026
Every table in this schema has row-level security switched on — 85 of 85, none opted out — enforced by 203 policies. A query that should not return your document does not return it, whether it came from a page, a script, a report or a mistake.
The system does not build up an answer from a permissions table. It asks the database, as you, and takes what comes back. That distinction is why there is no second copy of the rule to drift out of step with the first.
A thread is 'this firm', 'everyone on the case', or 'one side with the mediator'. Nobody maintains a recipient list, so nobody can maintain it wrongly.
Every policy and every column-level grant is listed against a manifest in the test suite. Add one, drop one, or widen one, and the build FAILS until a person edits that manifest deliberately. It does not know whether the change is right — it knows one was made, and it will not let it be silent.
Every combination of who-you-are and what-kind-of-thing-it-is is asserted explicitly, including every pair that must come back empty. A suite that only checks what people should see cannot catch a leak.
The matrix
Every one of these is asserted in the test suite, including the rows that must come back empty. The ones marked CANNOT are not hidden from a menu — the query returns nothing.
| Seat | What they reach | |
|---|---|---|
| You, the client | Your own matterEverything released to you, the moment it is released — and a document becomes visible when a person releases that document, not on a blanket setting. | CAN READ |
| Your own lawyers | Everything on the matterIncluding the conversation among themselves, which nobody outside the firm can reach. | CAN READ |
| Opposing counsel | The case, from their side of itThey hold a real login to the same file. What they can read is derived from the case and the side they are on — not from a permission somebody remembered to set. | CAN READ |
| Opposing counsel | Your side's private conversationNot hidden from a menu. Unreachable, because the row does not return to their seat. | CANNOT |
| A mediator | One side at a time, when they convene itA caucus can only be opened by the neutral. Not by either party, at any time. | CAN READ |
| The court | What is filed and servedAnd a channel that includes the bench cannot exclude anybody, which is what keeps it from becoming ex parte contact. | CAN READ |
| Anybody at all | A private message to one personThere is no such thing here. A channel that names its own recipients re-opens ex parte contact, caucus disclosure and Rule 4.02 all at once, so it does not exist and the build fails if anyone adds one. | CANNOT |
And everything is on the record
Every file, who released it, to whom, and when. A release is an act by a person with a name and a timestamp against it, one document at a time.
Threads live on the matter, with an audience the database derives. A message can become a task, so the thing you were reading when you decided something needs doing is the thing the task quotes.
Mail the system sends is queued, held during a quiet period, and stamped as sent only after it has actually gone — never before, so a failure cannot look like a delivery.
Work is timed where it happens. Every point that needs a human surfaces as a decision with a button, and approving it records who approved it and when.
Dates that come from a rule are computed from the rule. Dates a judge set are stored because a judge set them. The calendar keeps those apart, because they are different kinds of fact.
End-to-end encrypted, in the browser, and a call opens a work block when it starts and closes it when it ends — timed from the server, so a closed laptop cannot leave one running.
I will show them the policies. That offer is not usually available, and it is the point of building it this way.
Send your file →