Record-level rules: show each client only their data

[One-line summary of what the reader will build.]