Users, even though they cannot view customers or their information can access the "Create invoice" page. While they are unable to create an invoice they are able to view customer emails. If we are keeping information from customers and employees confidential this does not help. Would like users to not be able to contact customers whatsoever.