Mersal Restricted Matters and Ethical Walls
Locked is not the same as invisible
Some files must not exist for most of the firm. A sensitive client. An internal investigation into a partner. A matter where half the practice is already conflicted out. For these, the ordinary answer is a lock: the file is there, its name is there, its parties are there, but a permission flag denies entry. That is not an ethical wall. It is a closed door with the nameplate still on it.
A locked file leaks. The title appears in a global search. The client shows up in a conflict list. A colleague notices the matter number and asks. Each of these is a small confirmation that the matter exists, who it concerns, and roughly what it is about. For a genuinely restricted file, that inference is the breach.
Invisibility is the correct standard. To everyone outside the circle, the matter should return nothing: no row, no name, no count, no trace.
Where the wall has to stand
The question is not whether to build the wall but where. Draw it in the interface and you are trusting every screen, every report, every export and every future feature to remember to hide the same rows. One forgotten query is one disclosure. The application layer is the wrong altitude for a rule that must never fail.
The wall belongs at the database, below the application, where every query passes whether a developer remembered it or not. Mersal enforces this with Row-Level Security at the engine: every query is filtered by firm and role before it returns, and a restricted matter is simply absent to anyone outside its circle, with no application-side bypass.
A wall that lives in the code is only as strong as the last person who wrote a query.
A wall you can prove
An ethical wall must also be accountable. When a regulator or an opposing party asks whether a conflicted colleague could have seen the file, the firm needs an answer that is a record, not a recollection. Who was inside the circle. Who was added, by whom, and when. What crossed the wall and on whose authority.
This is why access control and the audit ledger belong together. In Mersal the operational record is append-only, enforced by database triggers that reject modification for every role, administrators included. The wall decides who may see; the ledger fixes who did, in a form no one can quietly revise.
A restricted matter is a promise the firm makes to a client, to a court, and to itself: that a name can be held without being spread. That promise cannot rest on discipline, memory, or the hope that no one runs the wrong search. It has to be built into the layer that answers every question, so that the answer for outsiders is not a polite refusal but genuine silence. Draw the wall where the queries run, and keep the proof beside it. A secret that depends on people remembering to keep it is already half told.
Matters, conflicts, VAT billing, sealed receipts and the docket, in one defensible system.