Who sees what?

Three kinds of person, three different views, enforced by the database rather than the menu.

Access is not a matter of which links get drawn. Each of these is enforced in the database, so going around the screen returns the same answer.

Administrator: The whole firm: billing, the crew, security signals, the approval queue, every project and every record on it.
Technician: The work. Cases, evidence capture, the assets they inspect, the schedule. No billing, no security signals, no other firm.
Owner or client: Their own job: the package, the assets, the deficiencies raised against their building, and the evidence behind every closed check. Not the firm's rate cards, and not its internal approval queue.
Subcontractor and vendor: Only what concerns them — the documents they owe and the equipment they supplied.