Client management is admin-only (requires manage_options capability) AJAX endpoints verify both the nonce and user capability Client data is stored in WordPress and protected by standard post permissions User assignment allows team members to access specific clients (admin-defined) Invoice Builder has a separate secure endpoint for client search (admin-only, no nopriv endpoint)