What about privacy, compliance, and the works council?

The default is the policy. By default, no individual user data is shared with managers or admins. Aggregate only. The individual owns the primary view of their granular data, with per-data-element opt-in sharing they can revoke any time. Enterprise-grade trust: SOC 2 Type II, ISO 27001, GDPR, CCPA, WCAG 2.1 AA, ISO 42001 trajectory.