… 26 unchanged lines …
  - Share cascading is how "why can this user see everything?" happens. One share on a parent propagates down every cascading relationship, and it's not visible anywhere obvious.
  - Turning cascading off doesn't retract access on its own — the cleanup job does, asynchronously, and it can fail. Don't assume the permission is gone the moment you save.
  - The single-parental-relationship rule bites when you add a second lookup later and find you can't configure it the way the first one is. Customer lookups and activity regarding lookups are the documented exceptions.
+ - A lookup leaks the related row's primary name. Anyone who can read the row holding the lookup sees the related record's ID and its primary name value, whether or not they have read access to the related record itself. Dataverse documents this as by design, so never put anything sensitive in a primary name column — a contract reference, a case subject, a person's name on a restricted table.
  - N:N relationships give you no place to store anything about the link, and converting to a junction table afterwards means migrating the intersect data by hand.
  
  ## Consultant notes