Client portal production protected mode requires Firebase Auth and client or client_user custom claims. Client users can only see approved and published shift reports, incident summaries, patrol proof, attendance, and site activity summaries. Private GPS trails, raw panic dispatch data, device tokens, proof-of-payment files, compliance documents, audit logs, support logs, and tenant admin controls remain hidden.