# Branch Isolation Report

## Implemented Controls

- Core models expose `scopeVisibleTo()` using `branch_id`.
- Controllers guard detail/edit/update/delete against branch mismatch.
- Form Requests reject cross-branch owners and related records.
- Dashboard, reports, and search filter by authenticated branch.

## Tested

- Leads owner branch validation.
- Companies cross-branch view denial.
- Contacts cross-branch view and company validation.
- Opportunities cross-branch view and company validation.
- Activities cross-branch view and company validation.
- Tickets cross-branch view and company validation.
- Global search excludes other-branch records.

## Remaining Gaps

- Full branch matrix tests are not complete for every method on every module.
- Timeline branch isolation is implemented through parent record access and activity branch filters, but needs broader dedicated tests.
- Reports branch isolation has metric tests but needs multi-branch report fixtures.

## Verdict

Core branch isolation is working in tested paths. Full enterprise-grade branch isolation matrix is incomplete.
