Access policy

Two audiences on one screen. External access decides when a collaborator outside SECO loses access; internal audiences decide who inside SECO gets reporting, who reads without working in the app, and who may raise a request.