- Restrict biometric attendances query and grouped records strictly to employees of assigned branch
- Scope bulk sync (syncAll) to only sync biometric records for employees within the user's branch
- Guard individual sync and custom sync against processing employees from foreign branches
- Tighten attendance records query to strictly filter by employee assigned branch
- Add feature test verifying biometric attendance isolation and permission guards