All deals
Needs attention
Worked out from the deals themselves — nothing here is a status somebody remembered to set.
Today
Why these and not a to-do list
Every item is computed from dates and state: how long a deal has sat in a stage, whether a rejected document was ever resent, whether an offer is about to expire. A to-do list goes stale the moment somebody forgets to tick it. This cannot.
Team & permissions
The principal decides what each person can do. Tick and untick below — the Deals tab changes immediately for whoever you are signed in as.
The referring agent is the one to get right
An estate agent who sent you the buyer wants to know whether the bond is approved. They do not need the buyer's salary, expenses or credit record, and under POPIA you should not be showing it to them. Give them their own deals and nothing else — switch to Riaan below and watch the financial columns disappear.
That is data minimisation doing real work, not a settings page nobody looks at.
One thing to get right in the database, not the interface
Every table needs the brokerage id, and every query must be scoped by it. A global scope in the model is not enough on its own — raw queries and validation rules that check whether a record exists can slip past it, and that is how one brokerage ends up seeing another's client. Scope it at the query layer and write a test that proves a user from one brokerage gets nothing from another.
Prototype. Brokerages, deals, users and figures are simulated. Permission names here are a starting point — the real set should be agreed with a brokerage principal before anything is built, and checked against POPIA for what each role genuinely needs to see.