⚠ Open question — same-org access escalation  Currently, switching from Driver to Manager within the same org is instant with no verification. Since Manager has significantly broader data access than Driver, this upward role escalation may warrant re-authentication — the lock badge pattern could apply here too. Switching down (Manager → Driver) is not a concern; you are reducing your own access. Recommend discussion with legal / governance team before build. See also data governance doc FD-12.

💡 Future consideration — combined role dashboard  An alternative to context-switching was discussed: a single post-login dashboard combining all roles' data and actions in one view. Advantages: fewer taps, no "which mode am I in?" friction for same-org multi-role users. Decided against for the current build — it complicates data minimisation (APP 3) and use/disclosure boundaries (APP 6), makes HVNL/CoR audit attribution less clear (who acted, in which capacity?), and still requires cross-org switching anyway, giving us two coexisting paradigms for no net gain. Context-switching remains the correct approach. A lighter future option worth revisiting: a "my tasks" nudge widget on the Manager dashboard surfacing pending Driver tasks without a full role switch, keeping attribution clean.