Every route checks the organisation boundary before the role, so an Analyst on one tenant cannot read another's findings even with a valid token. Reveal and export are separate permissions from view.