A permitting office wants counter staff to watch an agent draft checklist items while a homeowner sees only a simplified status strip. What architecture choice best protects that dual-audience design?

Dual-audience permitting UIs separate privileged operator surfaces from public status views. Keeping staff-only tools and draft checklist details in a privileged staff UI while the homeowner sees only a simplified status strip enforces least privilege and role-appropriate disclosure: counter staff need to watch the agent draft and intervene; the homeowner needs progress clarity without internal fields, draft language, or tool controls. That architecture protects the dual-audience design the office specified.

Exposing every staff tool and draft field in the public view fails because identical audiences collapse privilege boundaries and leak internal permitting workflow detail to applicants. Training homeowners onto the staff console fails by concept—it is not an architecture that protects dual views; it erases the public surface and expands the attack and confusion surface. Publishing staff credentials so homeowners can audit every step fails as an access-control anti-pattern: credentials are not a transparency feature, and real-time staff tooling is not a public API.

Exam caveat: the stem is about UI architecture and privilege separation for agent tooling, not about whether homeowners legally may request records through an open-records process after the fact.

Operational check: authenticate as staff and confirm draft checklist fields and agent tools are visible; authenticate as homeowner on the same case and confirm only status strip content appears; attempt a public session call to a staff-only tool endpoint and verify authorization denial.