Every action recorded. Every record isolated.
Staff see only what their role allows, and every meaningful action — a result verified, a prescription cancelled, a payment taken — is written to an audit trail that nobody, including admins, can erase or edit.