## 1. Shared Access Rules

- [x] 1.1 Add shared current-user access checks for platform audit and subject activity APIs.
- [x] 1.2 Guard the shared investigation loader so it does not request a platform audit API for agent or enterprise users.

## 2. Entry Points and Pages

- [x] 2.1 Update business audit entry points to pass current user type and use only supported subject activity targets for agents and enterprises.
- [x] 2.2 Hide or block platform audit routes and actions for agent and enterprise users.
- [x] 2.3 Keep finance, risk, Integration and link-timeline entries platform-only.

## 3. Read-only Verification

- [x] 3.1 Verify all audit and subject-activity methods used by the UI are GET-only.
- [x] 3.2 Verify platform, agent and enterprise users cannot trigger the wrong API family.
- [x] 3.3 Run lint and type checks for changed files.