Define who reports to whom in a visual org chart, then every list, board, and report respects it automatically. The boundary isn't a UI hint — it's enforced at the database, so even a curl request can't escape it.
Most CRMs filter records in the application layer. Anyone with API access can bypass it. BoldReach uses Postgres Row-Level Security policies on every CRM table — the database itself refuses to return rows the user shouldn't see, regardless of where the request came from.
Your COO needs visibility into a sales team they don't formally manage? Grant it once. Founders watch every team without being inserted into every reporting line? Pin them on the "sees entire workspace" pedestal.