Secure People Data

Employee data requires precise permissions: viewing a record should not automatically grant permission to edit or share it. Secure People Analytics is a working Python/Streamlit prototype using synthetic data for 20 employees. ClickHouse stores 60 monthly workforce analytics records and powers PTO and overtime dashboards. Backend queries restrict employees to their own records and managers to their direct reports. Employees can update their own phone number and address, while system-maintained PTO remains protected. Manager workflows support assigned leave approvals and denials without granting direct record-editing or export rights. Contact changes, leave decisions, and audit logs remain local. The security demo exercises attempts to access another employee's PTO, modify system-maintained PTO, and export restricted employee data. Backend authorization rejects prohibited actions, and the audit trail records allowed and denied attempts. Built-in chart and table download controls are removed. Built with Claude Code in Cursor. This prototype uses simulated identities and application-level authorization; real authentication and database-level hardening are future work.