An activity feed needs the same access check as the records it mentions

Most apps add an activity feed after the core screens are done: "Dana moved Q3 pricing review to Done." It usually reads from one events table filtered by workspace or project, and nobody ties it back