diff --git a/app/(dashboard)/bookkeeping/[id]/page.tsx b/app/(dashboard)/bookkeeping/[id]/page.tsx
index 61a190f1..5b51cb46 100644
--- a/app/(dashboard)/bookkeeping/[id]/page.tsx
+++ b/app/(dashboard)/bookkeeping/[id]/page.tsx
@@ -5,7 +5,8 @@ import Link from 'next/link'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
 import { AccountNumber } from '@/components/ui/account-number'
-import { Loader2, ArrowLeft, Paperclip, AlertTriangle } from 'lucide-react'
+import { Loader2, ArrowLeft, Paperclip, AlertTriangle, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import JournalEntryAttachments from '@/components/bookkeeping/JournalEntryAttachments'
 import JournalEntryStatusBadge, { sourceTypeLabels } from '@/components/bookkeeping/JournalEntryStatusBadge'
 import CorrectionEntryDialog from '@/components/bookkeeping/CorrectionEntryDialog'
@@ -14,6 +15,7 @@ import type { JournalEntry, JournalEntryLine } from '@/types'
 
 export default function JournalEntryDetailPage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = use(params)
+  const { canWrite } = useCanWrite()
   const [entry, setEntry] = useState<JournalEntry | null>(null)
   const [chain, setChain] = useState<JournalEntry[]>([])
   const [isLoading, setIsLoading] = useState(true)
@@ -124,7 +126,10 @@ export default function JournalEntryDetailPage({ params }: { params: Promise<{ i
             size="sm"
             className="w-full sm:w-auto"
             onClick={() => setShowCorrection(true)}
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
           >
+            {!canWrite && <Lock className="mr-2 h-4 w-4" />}
             Skapa ändringsverifikation
           </Button>
         )}
diff --git a/app/(dashboard)/customers/[id]/page.tsx b/app/(dashboard)/customers/[id]/page.tsx
index 0cc878fc..cfa6d9fa 100644
--- a/app/(dashboard)/customers/[id]/page.tsx
+++ b/app/(dashboard)/customers/[id]/page.tsx
@@ -23,7 +23,9 @@ import {
   Trash2,
   Loader2,
   Receipt,
+  Lock,
 } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { Customer, CustomerType, CreateCustomerInput } from '@/types'
 
 const customerTypeLabels: Record<CustomerType, string> = {
@@ -63,6 +65,7 @@ export default function CustomerDetailPage({
   const { id } = use(params)
   const router = useRouter()
   const { toast } = useToast()
+  const { canWrite } = useCanWrite()
   const [customer, setCustomer] = useState<CustomerWithRelations | null>(null)
   const [isLoading, setIsLoading] = useState(true)
   const [isEditOpen, setIsEditOpen] = useState(false)
@@ -203,8 +206,14 @@ export default function CustomerDetailPage({
         </div>
 
         <div className="flex items-center gap-2">
-          <Button variant="outline" size="sm" onClick={() => setIsEditOpen(true)}>
-            <Edit2 className="h-4 w-4 mr-1" />
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => setIsEditOpen(true)}
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+          >
+            {canWrite ? <Edit2 className="h-4 w-4 mr-1" /> : <Lock className="h-4 w-4 mr-1" />}
             Redigera
           </Button>
           <Button
@@ -212,8 +221,10 @@ export default function CustomerDetailPage({
             size="sm"
             onClick={handleDelete}
             className="text-destructive hover:text-destructive"
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
           >
-            <Trash2 className="h-4 w-4 mr-1" />
+            {canWrite ? <Trash2 className="h-4 w-4 mr-1" /> : <Lock className="h-4 w-4 mr-1" />}
             Ta bort
           </Button>
         </div>
diff --git a/app/(dashboard)/customers/page.tsx b/app/(dashboard)/customers/page.tsx
index 3d32b0ad..e0a3c799 100644
--- a/app/(dashboard)/customers/page.tsx
+++ b/app/(dashboard)/customers/page.tsx
@@ -8,11 +8,12 @@ import { Badge } from '@/components/ui/badge'
 import { Input } from '@/components/ui/input'
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogTrigger } from '@/components/ui/dialog'
 import { useToast } from '@/components/ui/use-toast'
-import { Plus, Search, Users } from 'lucide-react'
+import { Plus, Search, Users, Lock } from 'lucide-react'
 import CustomerForm from '@/components/customers/CustomerForm'
 import { EmptyCustomers } from '@/components/ui/empty-state'
 import Link from 'next/link'
 import { useCompany } from '@/contexts/CompanyContext'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { Customer, CustomerType, CreateCustomerInput } from '@/types'
 
 const customerTypeLabels: Record<CustomerType, string> = {
@@ -33,6 +34,7 @@ function getInitials(name: string): string {
 
 export default function CustomersPage() {
   const { company } = useCompany()
+  const { canWrite } = useCanWrite()
   const [customers, setCustomers] = useState<Customer[]>([])
   const [isLoading, setIsLoading] = useState(true)
   const [searchTerm, setSearchTerm] = useState('')
@@ -112,8 +114,15 @@ export default function CustomersPage() {
         </div>
         <Dialog open={isDialogOpen} onOpenChange={setIsDialogOpen}>
           <DialogTrigger asChild>
-            <Button>
-              <Plus className="mr-2 h-4 w-4" />
+            <Button
+              disabled={!canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {canWrite ? (
+                <Plus className="mr-2 h-4 w-4" />
+              ) : (
+                <Lock className="mr-2 h-4 w-4" />
+              )}
               Ny kund
             </Button>
           </DialogTrigger>
diff --git a/app/(dashboard)/expenses/new/page.tsx b/app/(dashboard)/expenses/new/page.tsx
index c65f2e22..e121d953 100644
--- a/app/(dashboard)/expenses/new/page.tsx
+++ b/app/(dashboard)/expenses/new/page.tsx
@@ -18,7 +18,8 @@ import AccountCombobox from '@/components/bookkeeping/AccountCombobox'
 import { getAccountDescription } from '@/lib/bookkeeping/account-descriptions'
 import { getErrorMessage } from '@/lib/errors/get-error-message'
 import { useUnsavedChanges } from '@/lib/hooks/use-unsaved-changes'
-import { ArrowLeft, Plus, Trash2, ChevronDown, Loader2 } from 'lucide-react'
+import { ArrowLeft, Plus, Trash2, ChevronDown, Loader2, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { Supplier, BASAccount, VatTreatment, EntityType } from '@/types'
 
 interface LineItem {
@@ -72,6 +73,7 @@ function inferVatTreatment(items: LineItem[], reverseCharge: boolean): VatTreatm
 
 export default function NewExpensePage() {
   const router = useRouter()
+  const { canWrite } = useCanWrite()
   const { toast } = useToast()
   const [suppliers, setSuppliers] = useState<Supplier[]>([])
   const [accounts, setAccounts] = useState<BASAccount[]>([])
@@ -704,12 +706,22 @@ export default function NewExpensePage() {
           <Button type="button" variant="outline" className="w-full sm:w-auto" onClick={() => router.push('/expenses')}>
             Avbryt
           </Button>
-          <Button type="submit" disabled={isSubmitting} className="w-full sm:w-auto">
+          <Button
+            type="submit"
+            disabled={isSubmitting || !canWrite}
+            className="w-full sm:w-auto"
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+          >
             {isSubmitting ? (
               <>
                 <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                 Registrerar...
               </>
+            ) : !canWrite ? (
+              <>
+                <Lock className="mr-2 h-4 w-4" />
+                {isEF ? 'Registrera utgift' : 'Granska & registrera'}
+              </>
             ) : isEF ? (
               'Registrera utgift'
             ) : (
diff --git a/app/(dashboard)/expenses/page.tsx b/app/(dashboard)/expenses/page.tsx
index 22588bf3..5b5911da 100644
--- a/app/(dashboard)/expenses/page.tsx
+++ b/app/(dashboard)/expenses/page.tsx
@@ -12,8 +12,9 @@ import { PageHeader } from '@/components/ui/page-header'
 import { EmptyState } from '@/components/ui/empty-state'
 import { useToast } from '@/components/ui/use-toast'
 import { formatCurrency } from '@/lib/utils'
-import { Plus, Search, Wallet, Clock, AlertCircle } from 'lucide-react'
+import { Plus, Search, Wallet, Clock, AlertCircle, Lock } from 'lucide-react'
 import { useCompany } from '@/contexts/CompanyContext'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { SupplierInvoice } from '@/types'
 
 type ExpenseInvoice = SupplierInvoice & { supplier?: { id: string; name: string } }
@@ -62,6 +63,7 @@ function getRelativeTimeLabel(dueDateStr: string, status: string): { text: strin
 
 export default function ExpensesPage() {
   const { company } = useCompany()
+  const { canWrite } = useCanWrite()
   const [invoices, setInvoices] = useState<ExpenseInvoice[]>([])
   const [isLoading, setIsLoading] = useState(true)
   const [searchTerm, setSearchTerm] = useState('')
@@ -119,12 +121,22 @@ export default function ExpensesPage() {
         title="Utgifter"
         description="Registrera och hantera dina utgifter"
         action={
-          <Link href="/expenses/new">
-            <Button>
-              <Plus className="mr-2 h-4 w-4" />
+          canWrite ? (
+            <Link href="/expenses/new">
+              <Button>
+                <Plus className="mr-2 h-4 w-4" />
+                Ny utgift
+              </Button>
+            </Link>
+          ) : (
+            <Button
+              disabled
+              title="Du har endast läsbehörighet i detta företag"
+            >
+              <Lock className="mr-2 h-4 w-4" />
               Ny utgift
             </Button>
-          </Link>
+          )
         }
       />
 
diff --git a/app/(dashboard)/invoices/[id]/credit/page.tsx b/app/(dashboard)/invoices/[id]/credit/page.tsx
index 93f89c02..21c23312 100644
--- a/app/(dashboard)/invoices/[id]/credit/page.tsx
+++ b/app/(dashboard)/invoices/[id]/credit/page.tsx
@@ -12,7 +12,8 @@ import { Separator } from '@/components/ui/separator'
 import { useToast } from '@/components/ui/use-toast'
 import { cn, formatCurrency, formatDate } from '@/lib/utils'
 import { getVatTreatmentLabel } from '@/lib/invoices/vat-rules'
-import { Loader2, ArrowLeft, AlertTriangle } from 'lucide-react'
+import { Loader2, ArrowLeft, AlertTriangle, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { Invoice, InvoiceItem, Customer } from '@/types'
 
 interface InvoiceWithRelations extends Invoice {
@@ -21,6 +22,7 @@ interface InvoiceWithRelations extends Invoice {
 }
 
 export default function CreateCreditNotePage({ params }: { params: Promise<{ id: string }> }) {
+  const { canWrite } = useCanWrite()
   const { id } = use(params)
   const router = useRouter()
   const { toast } = useToast()
@@ -325,13 +327,19 @@ export default function CreateCreditNotePage({ params }: { params: Promise<{ id:
         <Button
           variant="destructive"
           onClick={handleSubmit}
-          disabled={isSubmitting || confirmText !== invoice.invoice_number}
+          disabled={isSubmitting || confirmText !== invoice.invoice_number || !canWrite}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
         >
           {isSubmitting ? (
             <>
               <Loader2 className="mr-2 h-4 w-4 animate-spin" />
               Skapar...
             </>
+          ) : !canWrite ? (
+            <>
+              <Lock className="mr-2 h-4 w-4" />
+              Skapa kreditfaktura
+            </>
           ) : (
             'Skapa kreditfaktura'
           )}
diff --git a/app/(dashboard)/invoices/[id]/page.tsx b/app/(dashboard)/invoices/[id]/page.tsx
index b27ab7ee..97008bd7 100644
--- a/app/(dashboard)/invoices/[id]/page.tsx
+++ b/app/(dashboard)/invoices/[id]/page.tsx
@@ -26,7 +26,9 @@ import {
   AlertTriangle,
   MessageSquare,
   Trash2,
+  Lock,
 } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import PaymentBookingDialog from '@/components/invoices/PaymentBookingDialog'
 import SendInvoiceDialog from '@/components/invoices/SendInvoiceDialog'
 import {
@@ -62,6 +64,7 @@ interface InvoiceWithRelations extends Invoice {
 }
 
 export default function InvoiceDetailPage({ params }: { params: Promise<{ id: string }> }) {
+  const { canWrite } = useCanWrite()
   const { id } = use(params)
   const router = useRouter()
   const { toast } = useToast()
@@ -379,9 +382,15 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
         {/* Actions */}
         <div className="flex flex-wrap items-center gap-2">
           {isProforma && invoice.status !== 'cancelled' && (
-            <Button onClick={convertToInvoice} disabled={isConverting}>
+            <Button
+              onClick={convertToInvoice}
+              disabled={isConverting || !canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
               {isConverting ? (
                 <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+              ) : !canWrite ? (
+                <Lock className="mr-2 h-4 w-4" />
               ) : (
                 <FileText className="mr-2 h-4 w-4" />
               )}
@@ -390,26 +399,44 @@ export default function InvoiceDetailPage({ params }: { params: Promise<{ id: st
           )}
           {invoice.status === 'draft' && !isDeliveryNote && (
             customerHasEmail ? (
-              <Button onClick={() => openSendDialog('email')}>
-                <Mail className="mr-2 h-4 w-4" />
+              <Button
+                onClick={() => openSendDialog('email')}
+                disabled={!canWrite}
+                title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+              >
+                {canWrite ? <Mail className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
                 Skicka via e-post
               </Button>
             ) : (
-              <Button variant="secondary" onClick={() => openSendDialog('manual')}>
-                <Send className="mr-2 h-4 w-4" />
+              <Button
+                variant="secondary"
+                onClick={() => openSendDialog('manual')}
+                disabled={!canWrite}
+                title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+              >
+                {canWrite ? <Send className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
                 Skickad manuellt
               </Button>
             )
           )}
           {isDeliveryNote && invoice.status === 'draft' && (
-            <Button variant="secondary" onClick={() => updateStatus('sent')} disabled={isUpdating}>
-              <Send className="mr-2 h-4 w-4" />
+            <Button
+              variant="secondary"
+              onClick={() => updateStatus('sent')}
+              disabled={isUpdating || !canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {canWrite ? <Send className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
               Markera som skickad
             </Button>
           )}
           {(invoice.status === 'sent' || invoice.status === 'overdue') && isRealInvoice && (
-            <Button onClick={() => setShowPaymentDialog(true)} disabled={isUpdating}>
-              <CheckCircle className="mr-2 h-4 w-4" />
+            <Button
+              onClick={() => setShowPaymentDialog(true)}
+              disabled={isUpdating || !canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {canWrite ? <CheckCircle className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
               Markera som betald
             </Button>
           )}
diff --git a/app/(dashboard)/invoices/new/page.tsx b/app/(dashboard)/invoices/new/page.tsx
index bb899a71..d070760c 100644
--- a/app/(dashboard)/invoices/new/page.tsx
+++ b/app/(dashboard)/invoices/new/page.tsx
@@ -19,7 +19,8 @@ import { useToast } from '@/components/ui/use-toast'
 import { formatCurrency } from '@/lib/utils'
 import { getVatRules, getAvailableVatRates } from '@/lib/invoices/vat-rules'
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, DialogFooter } from '@/components/ui/dialog'
-import { Loader2, Plus, Trash2, ArrowLeft, Send, Eye, Landmark } from 'lucide-react'
+import { Loader2, Plus, Trash2, ArrowLeft, Send, Eye, Landmark, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import { ConfirmationDialog } from '@/components/ui/confirmation-dialog'
 import { InvoiceReviewContent } from '@/components/invoices/InvoiceReviewContent'
 import { getErrorMessage } from '@/lib/errors/get-error-message'
@@ -57,6 +58,7 @@ const units = ['st', 'tim', 'dag', 'månad', 'km', 'kg']
 export default function NewInvoicePage() {
   const router = useRouter()
   const { toast } = useToast()
+  const { canWrite } = useCanWrite()
   const supabase = createClient()
 
   const [customers, setCustomers] = useState<Customer[]>([])
@@ -763,7 +765,14 @@ export default function NewInvoicePage() {
             </Card>
 
             {/* Actions — desktop only */}
-            <Button type="submit" className="w-full hidden lg:block" size="lg" disabled={isSubmitting}>
+            <Button
+              type="submit"
+              className="w-full hidden lg:block"
+              size="lg"
+              disabled={isSubmitting || !canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {!canWrite && <Lock className="mr-2 h-4 w-4 inline" />}
               Granska & skapa
             </Button>
           </div>
@@ -776,7 +785,12 @@ export default function NewInvoicePage() {
               <p className="text-xs text-muted-foreground">Totalt</p>
               <p className="text-lg font-bold tabular-nums">{formatCurrency(total, watchCurrency)}</p>
             </div>
-            <Button type="submit" disabled={isSubmitting}>
+            <Button
+              type="submit"
+              disabled={isSubmitting || !canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {!canWrite && <Lock className="mr-2 h-4 w-4 inline" />}
               Granska & skapa
             </Button>
           </div>
diff --git a/app/(dashboard)/invoices/page.tsx b/app/(dashboard)/invoices/page.tsx
index 8de1dd51..445d932c 100644
--- a/app/(dashboard)/invoices/page.tsx
+++ b/app/(dashboard)/invoices/page.tsx
@@ -13,9 +13,10 @@ import { PageHeader } from '@/components/ui/page-header'
 import { useToast } from '@/components/ui/use-toast'
 import { formatCurrency, formatDate } from '@/lib/utils'
 import { cn } from '@/lib/utils'
-import { Plus, Search, Receipt } from 'lucide-react'
+import { Plus, Search, Receipt, Lock } from 'lucide-react'
 import { EmptyInvoices } from '@/components/ui/empty-state'
 import { useCompany } from '@/contexts/CompanyContext'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { Invoice, InvoiceStatus } from '@/types'
 
 const statusConfig: Record<InvoiceStatus, { label: string; variant: 'default' | 'secondary' | 'success' | 'warning' | 'destructive'; borderColor: string }> = {
@@ -51,6 +52,7 @@ function getRelativeTimeLabel(dueDateStr: string, status: InvoiceStatus): { text
 
 export default function InvoicesPage() {
   const { company } = useCompany()
+  const { canWrite } = useCanWrite()
   const [invoices, setInvoices] = useState<Invoice[]>([])
   const [isLoading, setIsLoading] = useState(true)
   const [searchTerm, setSearchTerm] = useState('')
@@ -115,12 +117,22 @@ export default function InvoicesPage() {
         title="Fakturor"
         description="Skicka fakturor, följ betalningar och skapa kreditnotor"
         action={
-          <Link href="/invoices/new">
-            <Button>
-              <Plus className="mr-2 h-4 w-4" />
+          canWrite ? (
+            <Link href="/invoices/new">
+              <Button>
+                <Plus className="mr-2 h-4 w-4" />
+                Ny faktura
+              </Button>
+            </Link>
+          ) : (
+            <Button
+              disabled
+              title="Du har endast läsbehörighet i detta företag"
+            >
+              <Lock className="mr-2 h-4 w-4" />
               Ny faktura
             </Button>
-          </Link>
+          )
         }
       />
 
diff --git a/app/(dashboard)/layout.tsx b/app/(dashboard)/layout.tsx
index 299900dd..8ffa69c3 100644
--- a/app/(dashboard)/layout.tsx
+++ b/app/(dashboard)/layout.tsx
@@ -1,7 +1,8 @@
 import { createClient } from '@/lib/supabase/server'
 import { redirect } from 'next/navigation'
-import { cookies } from 'next/headers'
+import { headers } from 'next/headers'
 import DashboardNav from '@/components/dashboard/DashboardNav'
+import CompanyTabSync from '@/components/dashboard/CompanyTabSync'
 import { RecaptIdentify } from '@/components/RecaptIdentify'
 import { SentryIdentify } from '@/components/SentryIdentify'
 import { SandboxBanner } from '@/components/dashboard/SandboxBanner'
@@ -10,6 +11,13 @@ import { CompanyProvider } from '@/contexts/CompanyContext'
 import { getActiveCompanyId } from '@/lib/company/context'
 import type { EntityType, CompanyRole, Team } from '@/types'
 
+/**
+ * Routes inside the dashboard group that must remain reachable when the
+ * user has no active company. Keep in sync with the middleware's
+ * no-company allowlist.
+ */
+const NO_COMPANY_ALLOWED_PATHS = ['/settings/account']
+
 export default async function DashboardLayout({
   children,
 }: {
@@ -23,9 +31,19 @@ export default async function DashboardLayout({
     redirect('/login')
   }
 
-  const cookieStore = await cookies()
-  const companyId = cookieStore.get('gnubok-company-id')?.value
-    ?? await getActiveCompanyId(supabase, user.id)
+  // Resolve active company from user_preferences (authoritative). The
+  // `gnubok-company-id` cookie is intentionally no longer consulted here —
+  // `getActiveCompanyId` reads from user_preferences, matching what RLS
+  // sees via `current_active_company_id()`. Keeping both sides on the same
+  // source avoids cross-tab / cookie divergence.
+  const companyId = await getActiveCompanyId(supabase, user.id)
+
+  // Read the pathname forwarded by middleware so we can branch on it.
+  const headerStore = await headers()
+  const pathname = headerStore.get('x-pathname') ?? ''
+  const isNoCompanyAllowed = NO_COMPANY_ALLOWED_PATHS.some((p) =>
+    pathname.startsWith(p)
+  )
 
   // Fetch team membership + team info
   const { data: teamMembership } = await supabase
@@ -47,9 +65,47 @@ export default async function DashboardLayout({
 
   const isTeamMember = !!teamMembership
 
-  // No companies — redirect to onboarding
+  // No companies — redirect to onboarding, except for allowed escape-hatch
+  // routes (so the user can still reach /settings/account to delete their
+  // account after archiving their last company).
   if (!companyId) {
-    redirect('/onboarding')
+    if (!isNoCompanyAllowed) {
+      redirect('/onboarding')
+    }
+
+    return (
+      <CompanyProvider
+        value={{
+          company: null,
+          role: null,
+          companies: [],
+          isTeamMember,
+          team,
+        }}
+      >
+        <CompanyTabSync />
+        <div className="min-h-screen bg-background">
+          <DashboardNav
+            companyName="gnubok"
+            entityType="enskild_firma"
+            uncategorizedTransactionCount={0}
+            pendingOperationsCount={0}
+            isSandbox={false}
+            extensionNavItems={getExtensionNavItems()}
+          />
+          <main
+            id="main-content"
+            className="safe-area-main-padding md:!pb-0 md:pl-[232px]"
+            role="main"
+          >
+            <div className="max-w-5xl mx-auto px-5 py-8 md:px-8 md:py-10">
+              {children}
+            </div>
+          </main>
+          <SentryIdentify userId={user.id} email={user.email} />
+        </div>
+      </CompanyProvider>
+    )
   }
 
   // Fetch company + membership for context provider
@@ -79,6 +135,7 @@ export default async function DashboardLayout({
 
     return (
       <CompanyProvider value={companyContextValue}>
+        <CompanyTabSync />
         <div className="min-h-screen bg-background">
           <DashboardNav
             companyName="gnubok"
@@ -145,6 +202,7 @@ export default async function DashboardLayout({
 
   return (
     <CompanyProvider value={companyContextValue}>
+      <CompanyTabSync />
       <div className="min-h-screen bg-background">
         {/* Skip to content link for keyboard/screen reader users */}
         <a
diff --git a/app/(dashboard)/settings/company/page.tsx b/app/(dashboard)/settings/company/page.tsx
index fcc58266..31f0eefd 100644
--- a/app/(dashboard)/settings/company/page.tsx
+++ b/app/(dashboard)/settings/company/page.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import { CompanyDangerZone } from '@/components/settings/CompanyDangerZone'
 import { CompanyInfoForm } from '@/components/settings/CompanyInfoForm'
 import { CompanyMembersSection } from '@/components/settings/CompanyMembersSection'
 import { LogoUpload } from '@/components/settings/LogoUpload'
@@ -49,6 +50,8 @@ export default function CompanySettingsPage() {
       <div className="border-t border-border/8 pt-8">
         <CompanyMembersSection />
       </div>
+
+      <CompanyDangerZone />
     </div>
   )
 }
diff --git a/app/(dashboard)/supplier-invoices/[id]/page.tsx b/app/(dashboard)/supplier-invoices/[id]/page.tsx
index 236930d6..79409e8a 100644
--- a/app/(dashboard)/supplier-invoices/[id]/page.tsx
+++ b/app/(dashboard)/supplier-invoices/[id]/page.tsx
@@ -9,7 +9,8 @@ import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog'
 import { useToast } from '@/components/ui/use-toast'
-import { ArrowLeft, CheckCircle, CreditCard, FileText, Trash2 } from 'lucide-react'
+import { ArrowLeft, CheckCircle, CreditCard, FileText, Trash2, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import Link from 'next/link'
 import { AccountNumber } from '@/components/ui/account-number'
 import { DestructiveConfirmDialog, useDestructiveConfirm } from '@/components/ui/destructive-confirm-dialog'
@@ -40,6 +41,7 @@ const statusLabels: Record<string, string> = {
 }
 
 export default function SupplierInvoiceDetailPage() {
+  const { canWrite } = useCanWrite()
   const params = useParams()
   const router = useRouter()
   const { toast } = useToast()
@@ -189,24 +191,43 @@ export default function SupplierInvoiceDetailPage() {
         <div className="flex flex-wrap gap-2">
           {invoice.status === 'registered' && (
             <>
-              <Button onClick={handleApprove} disabled={isProcessing}>
-                <CheckCircle className="mr-2 h-4 w-4" />
+              <Button
+                onClick={handleApprove}
+                disabled={isProcessing || !canWrite}
+                title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+              >
+                {canWrite ? <CheckCircle className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
                 Godkänn
               </Button>
-              <Button variant="destructive" size="icon" onClick={handleDelete} disabled={isProcessing}>
-                <Trash2 className="h-4 w-4" />
+              <Button
+                variant="destructive"
+                size="icon"
+                onClick={handleDelete}
+                disabled={isProcessing || !canWrite}
+                title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+              >
+                {canWrite ? <Trash2 className="h-4 w-4" /> : <Lock className="h-4 w-4" />}
               </Button>
             </>
           )}
           {['approved', 'overdue', 'partially_paid'].includes(invoice.status) && (
             <>
-              <Button onClick={() => setIsPayDialogOpen(true)} disabled={isProcessing}>
-                <CreditCard className="mr-2 h-4 w-4" />
+              <Button
+                onClick={() => setIsPayDialogOpen(true)}
+                disabled={isProcessing || !canWrite}
+                title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+              >
+                {canWrite ? <CreditCard className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
                 Markera betald
               </Button>
               {invoice.status !== 'partially_paid' && (
-                <Button variant="outline" onClick={handleCredit} disabled={isProcessing}>
-                  <FileText className="mr-2 h-4 w-4" />
+                <Button
+                  variant="outline"
+                  onClick={handleCredit}
+                  disabled={isProcessing || !canWrite}
+                  title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+                >
+                  {canWrite ? <FileText className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
                   Kreditfaktura
                 </Button>
               )}
diff --git a/app/(dashboard)/supplier-invoices/new/page.tsx b/app/(dashboard)/supplier-invoices/new/page.tsx
index 25c1659e..f70e7f23 100644
--- a/app/(dashboard)/supplier-invoices/new/page.tsx
+++ b/app/(dashboard)/supplier-invoices/new/page.tsx
@@ -11,7 +11,8 @@ import { Textarea } from '@/components/ui/textarea'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
 import { Checkbox } from '@/components/ui/checkbox'
 import { useToast } from '@/components/ui/use-toast'
-import { ArrowLeft, Plus, Trash2 } from 'lucide-react'
+import { ArrowLeft, Plus, Trash2, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import { ConfirmationDialog } from '@/components/ui/confirmation-dialog'
 import { SupplierInvoiceReviewContent } from '@/components/suppliers/SupplierInvoiceReviewContent'
 import AccountCombobox from '@/components/bookkeeping/AccountCombobox'
@@ -62,6 +63,7 @@ function inferVatTreatment(items: LineItem[], reverseCharge: boolean): VatTreatm
 
 export default function NewSupplierInvoicePage() {
   const router = useRouter()
+  const { canWrite } = useCanWrite()
   const { toast } = useToast()
   const [suppliers, setSuppliers] = useState<Supplier[]>([])
   const [accounts, setAccounts] = useState<BASAccount[]>([])
@@ -579,7 +581,12 @@ export default function NewSupplierInvoicePage() {
           <Button type="button" variant="outline" onClick={() => router.push('/supplier-invoices')}>
             Avbryt
           </Button>
-          <Button type="submit" disabled={isSubmitting}>
+          <Button
+            type="submit"
+            disabled={isSubmitting || !canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+          >
+            {!canWrite && <Lock className="mr-2 h-4 w-4 inline" />}
             Granska & registrera
           </Button>
         </div>
diff --git a/app/(dashboard)/supplier-invoices/page.tsx b/app/(dashboard)/supplier-invoices/page.tsx
index 5733bdae..0d4e3123 100644
--- a/app/(dashboard)/supplier-invoices/page.tsx
+++ b/app/(dashboard)/supplier-invoices/page.tsx
@@ -5,8 +5,9 @@ import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
 import { Tabs, TabsList, TabsTrigger, TabsContent } from '@/components/ui/tabs'
-import { Plus, FileInput } from 'lucide-react'
+import { Plus, FileInput, Lock } from 'lucide-react'
 import Link from 'next/link'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { SupplierInvoice } from '@/types'
 
 function formatAmount(amount: number): string {
@@ -34,6 +35,7 @@ const statusLabels: Record<string, string> = {
 }
 
 export default function SupplierInvoicesPage() {
+  const { canWrite } = useCanWrite()
   const [invoices, setInvoices] = useState<(SupplierInvoice & { supplier?: { id: string; name: string } })[]>([])
   const [isLoading, setIsLoading] = useState(true)
   const [activeTab, setActiveTab] = useState('all')
@@ -78,12 +80,22 @@ export default function SupplierInvoicesPage() {
             Registrera och hantera inkommande fakturor
           </p>
         </div>
-        <Link href="/supplier-invoices/new">
-          <Button>
-            <Plus className="mr-2 h-4 w-4" />
+        {canWrite ? (
+          <Link href="/supplier-invoices/new">
+            <Button>
+              <Plus className="mr-2 h-4 w-4" />
+              Registrera faktura
+            </Button>
+          </Link>
+        ) : (
+          <Button
+            disabled
+            title="Du har endast läsbehörighet i detta företag"
+          >
+            <Lock className="mr-2 h-4 w-4" />
             Registrera faktura
           </Button>
-        </Link>
+        )}
       </div>
 
       {/* Summary cards */}
@@ -182,7 +194,7 @@ export default function SupplierInvoicesPage() {
                     ? 'Registrera din första leverantörsfaktura'
                     : 'Inga fakturor i denna kategori'}
                 </p>
-                {activeTab === 'all' && (
+                {activeTab === 'all' && canWrite && (
                   <Link href="/supplier-invoices/new">
                     <Button className="mt-4">
                       <Plus className="mr-2 h-4 w-4" />
diff --git a/app/(dashboard)/suppliers/[id]/page.tsx b/app/(dashboard)/suppliers/[id]/page.tsx
index 2ed29c76..05525a6e 100644
--- a/app/(dashboard)/suppliers/[id]/page.tsx
+++ b/app/(dashboard)/suppliers/[id]/page.tsx
@@ -7,7 +7,8 @@ import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { Badge } from '@/components/ui/badge'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog'
 import { useToast } from '@/components/ui/use-toast'
-import { ArrowLeft, Edit, Trash2, FileText } from 'lucide-react'
+import { ArrowLeft, Edit, Trash2, FileText, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import SupplierForm from '@/components/suppliers/SupplierForm'
 import Link from 'next/link'
 import { DestructiveConfirmDialog, useDestructiveConfirm } from '@/components/ui/destructive-confirm-dialog'
@@ -24,6 +25,7 @@ function formatAmount(amount: number): string {
 }
 
 export default function SupplierDetailPage() {
+  const { canWrite } = useCanWrite()
   const params = useParams()
   const router = useRouter()
   const { toast } = useToast()
@@ -153,12 +155,23 @@ export default function SupplierDetailPage() {
           </div>
         </div>
         <div className="flex gap-2">
-          <Button variant="outline" onClick={() => setIsEditOpen(true)}>
-            <Edit className="mr-2 h-4 w-4" />
+          <Button
+            variant="outline"
+            onClick={() => setIsEditOpen(true)}
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+          >
+            {canWrite ? <Edit className="mr-2 h-4 w-4" /> : <Lock className="mr-2 h-4 w-4" />}
             Redigera
           </Button>
-          <Button variant="destructive" size="icon" onClick={handleDelete}>
-            <Trash2 className="h-4 w-4" />
+          <Button
+            variant="destructive"
+            size="icon"
+            onClick={handleDelete}
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+          >
+            {canWrite ? <Trash2 className="h-4 w-4" /> : <Lock className="h-4 w-4" />}
           </Button>
         </div>
       </div>
diff --git a/app/(dashboard)/suppliers/page.tsx b/app/(dashboard)/suppliers/page.tsx
index 37350712..b7ef0efa 100644
--- a/app/(dashboard)/suppliers/page.tsx
+++ b/app/(dashboard)/suppliers/page.tsx
@@ -8,10 +8,11 @@ import { Badge } from '@/components/ui/badge'
 import { Input } from '@/components/ui/input'
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogTrigger } from '@/components/ui/dialog'
 import { useToast } from '@/components/ui/use-toast'
-import { Plus, Search, Building2, Globe } from 'lucide-react'
+import { Plus, Search, Building2, Globe, Lock } from 'lucide-react'
 import SupplierForm from '@/components/suppliers/SupplierForm'
 import Link from 'next/link'
 import { useCompany } from '@/contexts/CompanyContext'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { Supplier, SupplierType, CreateSupplierInput } from '@/types'
 
 const supplierTypeLabels: Record<SupplierType, string> = {
@@ -28,6 +29,7 @@ const supplierTypeIcons: Record<SupplierType, React.ElementType> = {
 
 export default function SuppliersPage() {
   const { company } = useCompany()
+  const { canWrite } = useCanWrite()
   const [suppliers, setSuppliers] = useState<Supplier[]>([])
   const [isLoading, setIsLoading] = useState(true)
   const [searchTerm, setSearchTerm] = useState('')
@@ -108,8 +110,15 @@ export default function SuppliersPage() {
         </div>
         <Dialog open={isDialogOpen} onOpenChange={setIsDialogOpen}>
           <DialogTrigger asChild>
-            <Button>
-              <Plus className="mr-2 h-4 w-4" />
+            <Button
+              disabled={!canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {canWrite ? (
+                <Plus className="mr-2 h-4 w-4" />
+              ) : (
+                <Lock className="mr-2 h-4 w-4" />
+              )}
               Ny leverantör
             </Button>
           </DialogTrigger>
@@ -169,8 +178,17 @@ export default function SuppliersPage() {
                 <p className="text-muted-foreground text-center mt-1">
                   Lägg till din första leverantör för att börja registrera inköpsfakturor
                 </p>
-                <Button className="mt-4" onClick={() => setIsDialogOpen(true)}>
-                  <Plus className="mr-2 h-4 w-4" />
+                <Button
+                  className="mt-4"
+                  onClick={() => setIsDialogOpen(true)}
+                  disabled={!canWrite}
+                  title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+                >
+                  {canWrite ? (
+                    <Plus className="mr-2 h-4 w-4" />
+                  ) : (
+                    <Lock className="mr-2 h-4 w-4" />
+                  )}
                   Ny leverantör
                 </Button>
               </div>
diff --git a/app/(onboarding)/layout.tsx b/app/(onboarding)/layout.tsx
index b61069a0..fe76bc1b 100644
--- a/app/(onboarding)/layout.tsx
+++ b/app/(onboarding)/layout.tsx
@@ -1,4 +1,6 @@
-import { createClient } from '@/lib/supabase/server'
+import Link from 'next/link'
+import { Settings } from 'lucide-react'
+import { createClient, createServiceClient } from '@/lib/supabase/server'
 import { SentryIdentify } from '@/components/SentryIdentify'
 
 export default async function OnboardingLayout({
@@ -9,11 +11,48 @@ export default async function OnboardingLayout({
   const supabase = await createClient()
   const { data: { user } } = await supabase.auth.getUser()
 
+  // Only show the settings escape hatch for users who have completed
+  // onboarding at least once — i.e. they have a company_members row, even if
+  // it points to an archived company. Absolute first-time users don't need
+  // it and it clutters the welcome screen.
+  //
+  // Must use the service client: RLS on company_members goes through
+  // user_company_ids(), which filters out archived companies, so an
+  // authenticated query would return nothing for a user who archived their
+  // last company and make the escape hatch disappear exactly when it's
+  // needed most. Scoped to user_id = user.id, so no cross-user exposure.
+  let hasCompletedOnboarding = false
+  if (user) {
+    const service = createServiceClient()
+    const { data } = await service
+      .from('company_members')
+      .select('company_id')
+      .eq('user_id', user.id)
+      .limit(1)
+      .maybeSingle()
+    hasCompletedOnboarding = !!data
+  }
+
   return (
     <div className="min-h-screen bg-background flex items-center justify-center">
       <div className="w-full max-w-lg px-5">
         {children}
       </div>
+
+      {/* Escape hatch: a user who archived their last company can still
+          reach account settings (and the delete-account flow) from here.
+          Hidden for absolute first-time users (no memberships ever). */}
+      {user && hasCompletedOnboarding && (
+        <Link
+          href="/settings/account"
+          aria-label="Kontoinställningar"
+          title="Kontoinställningar"
+          className="fixed bottom-5 right-5 z-50 flex h-10 w-10 items-center justify-center rounded-full border border-border bg-background/80 text-muted-foreground shadow-sm backdrop-blur transition-colors hover:border-foreground/40 hover:text-foreground"
+        >
+          <Settings className="h-4 w-4" />
+        </Link>
+      )}
+
       {user && <SentryIdentify userId={user.id} email={user.email} />}
     </div>
   )
diff --git a/app/api/account/delete/__tests__/route.test.ts b/app/api/account/delete/__tests__/route.test.ts
new file mode 100644
index 00000000..afb2db81
--- /dev/null
+++ b/app/api/account/delete/__tests__/route.test.ts
@@ -0,0 +1,154 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createMockRequest, parseJsonResponse } from '@/tests/helpers'
+import { eventBus } from '@/lib/events'
+
+vi.mock('@/lib/init', () => ({
+  ensureInitialized: vi.fn(),
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: vi.fn(),
+  createServiceClient: vi.fn(),
+}))
+
+import { createClient, createServiceClient } from '@/lib/supabase/server'
+import { POST } from '../route'
+
+const mockCreateClient = vi.mocked(createClient)
+const mockCreateServiceClient = vi.mocked(createServiceClient)
+
+function mockAuth(
+  user: { id: string; email: string | null } | null,
+  rpcResult: { data?: unknown; error?: unknown } = { data: null, error: null }
+) {
+  const signOut = vi.fn().mockResolvedValue({ error: null })
+  const rpc = vi.fn().mockResolvedValue(rpcResult)
+
+  mockCreateClient.mockResolvedValue({
+    auth: {
+      getUser: vi.fn().mockResolvedValue({ data: { user } }),
+      signOut,
+    },
+    rpc,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  } as any)
+
+  return { rpc, signOut }
+}
+
+function mockServiceClient(blockers: { id: string; name: string }[] = []) {
+  const updateUserById = vi.fn().mockResolvedValue({ data: {}, error: null })
+  const adminSignOut = vi.fn().mockResolvedValue({ data: null, error: null })
+
+  const chain = {
+    select: vi.fn().mockReturnThis(),
+    eq: vi.fn().mockReturnThis(),
+    is: vi.fn().mockResolvedValue({
+      data: blockers.map((b) => ({ companies: { id: b.id, name: b.name } })),
+      error: null,
+    }),
+  }
+
+  mockCreateServiceClient.mockReturnValue({
+    from: vi.fn().mockReturnValue(chain),
+    auth: {
+      admin: {
+        updateUserById,
+        signOut: adminSignOut,
+      },
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  } as any)
+
+  return { updateUserById, adminSignOut }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  eventBus.clear()
+})
+
+describe('POST /api/account/delete', () => {
+  it('returns 401 when unauthenticated', async () => {
+    mockAuth(null)
+
+    const req = createMockRequest('/api/account/delete', {
+      method: 'POST',
+      body: { confirm_email: 'u@example.com' },
+    })
+    const { status } = await parseJsonResponse(await POST(req))
+    expect(status).toBe(401)
+  })
+
+  it('returns 400 when confirm_email does not match', async () => {
+    mockAuth({ id: 'user-1', email: 'right@example.com' })
+
+    const req = createMockRequest('/api/account/delete', {
+      method: 'POST',
+      body: { confirm_email: 'wrong@example.com' },
+    })
+    const { status, body } = await parseJsonResponse(await POST(req))
+    expect(status).toBe(400)
+    expect(body).toHaveProperty('error')
+  })
+
+  it('returns 409 with blockers when RPC raises P0001', async () => {
+    mockAuth(
+      { id: 'user-1', email: 'u@example.com' },
+      { data: null, error: { code: 'P0001', message: 'blocked' } }
+    )
+    mockServiceClient([{ id: 'c1', name: 'Acme AB' }])
+
+    const req = createMockRequest('/api/account/delete', {
+      method: 'POST',
+      body: { confirm_email: 'u@example.com' },
+    })
+    const { status, body } = await parseJsonResponse<{
+      error: string
+      blockers: { id: string; name: string }[]
+    }>(await POST(req))
+
+    expect(status).toBe(409)
+    expect(body.blockers).toEqual([{ id: 'c1', name: 'Acme AB' }])
+  })
+
+  it('anonymizes, bans, signs out, and emits event on happy path', async () => {
+    const { rpc } = mockAuth({ id: 'user-1', email: 'u@example.com' })
+    const { updateUserById, adminSignOut } = mockServiceClient()
+
+    const emitted: unknown[] = []
+    eventBus.on('account.deleted', (payload) => {
+      emitted.push(payload)
+    })
+
+    const req = createMockRequest('/api/account/delete', {
+      method: 'POST',
+      body: { confirm_email: 'u@example.com' },
+    })
+    const { status, body } = await parseJsonResponse<{ success: boolean }>(
+      await POST(req)
+    )
+
+    expect(status).toBe(200)
+    expect(body.success).toBe(true)
+
+    expect(rpc).toHaveBeenCalledWith('anonymize_user_account', {
+      target_user_id: 'user-1',
+    })
+    expect(updateUserById).toHaveBeenCalledWith(
+      'user-1',
+      expect.objectContaining({
+        user_metadata: {},
+        app_metadata: {},
+        ban_duration: expect.any(String),
+      })
+    )
+    // Email must NOT be scrubbed — retaining it is what blocks re-signup
+    // with the same address. Recovery goes through support instead.
+    const updatePayload = updateUserById.mock.calls[0][1]
+    expect(updatePayload).not.toHaveProperty('email')
+    expect(adminSignOut).toHaveBeenCalledWith('user-1', 'global')
+    expect(emitted).toHaveLength(1)
+    expect(emitted[0]).toMatchObject({ userId: 'user-1' })
+  })
+})
diff --git a/app/api/account/delete/route.ts b/app/api/account/delete/route.ts
index f903451f..a3c6b257 100644
--- a/app/api/account/delete/route.ts
+++ b/app/api/account/delete/route.ts
@@ -1,56 +1,137 @@
-import { createClient } from '@/lib/supabase/server'
+import { createClient, createServiceClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
+import { ensureInitialized } from '@/lib/init'
+import { validateBody } from '@/lib/api/validate'
+import { eventBus } from '@/lib/events'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('api/account/delete')
+
+ensureInitialized()
 
 const DeleteAccountSchema = z.object({
-  confirm: z.literal('RADERA'),
+  confirm_email: z.string().email(),
 })
 
+/**
+ * POST /api/account/delete
+ *
+ * Anonymizes the calling user's account. The auth.users row is retained
+ * (banned for ~100 years) as a tombstone so FKs into BFL-retained
+ * bookkeeping data (companies.created_by, audit_log.user_id, etc.) stay
+ * valid. Memberships are removed, profile PII is stripped, and a global
+ * signout forces all sessions to end.
+ *
+ * Precondition: the user must own zero non-archived companies. The RPC
+ * enforces this at the DB level and raises SQLSTATE P0001 with a message
+ * if the precondition fails — we return 409 in that case.
+ */
 export async function POST(request: Request) {
   const supabase = await createClient()
 
   const { data: { user } } = await supabase.auth.getUser()
-
   if (!user) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  let body: unknown
-  try {
-    body = await request.json()
-  } catch {
-    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
-  }
+  const result = await validateBody(request, DeleteAccountSchema)
+  if (!result.success) return result.response
+  const { confirm_email } = result.data
 
-  const parsed = DeleteAccountSchema.safeParse(body)
-  if (!parsed.success) {
+  if (!user.email || confirm_email.trim().toLowerCase() !== user.email.toLowerCase()) {
     return NextResponse.json(
-      { error: 'Skriv RADERA för att bekräfta kontoborttagning' },
+      { error: 'E-postadressen stämmer inte överens med ditt konto.' },
       { status: 400 }
     )
   }
 
-  try {
-    // RPC disables protective triggers, deletes from auth.users (CASCADE
-    // cleans up all public tables), then re-enables triggers — all in one tx.
-    const { error } = await supabase.rpc('delete_user_account', {
-      target_user_id: user.id,
-    })
+  // Anonymize in the DB. Runs as SECURITY DEFINER and checks auth.uid()
+  // internally, so we don't need service role here.
+  const { error: rpcError } = await supabase.rpc('anonymize_user_account', {
+    target_user_id: user.id,
+  })
+
+  if (rpcError) {
+    // P0001 = precondition violation from our RPC: user still owns active
+    // companies. Re-fetch the blockers and return 409 so the UI can show
+    // the list inline.
+    if (rpcError.code === 'P0001') {
+      const service = createServiceClient()
+      const { data: blockers } = await service
+        .from('company_members')
+        .select('company_id, companies!inner(id, name, archived_at)')
+        .eq('user_id', user.id)
+        .eq('role', 'owner')
+        .is('companies.archived_at', null)
+
+      const list = (blockers ?? []).map((b) => {
+        const company = (b.companies as unknown) as { id: string; name: string }
+        return { id: company.id, name: company.name }
+      })
 
-    if (error) {
-      console.error('Failed to delete user:', error)
       return NextResponse.json(
-        { error: 'Kunde inte radera kontot. Försök igen.' },
-        { status: 500 }
+        {
+          error: 'Du måste radera eller överlåta dina företag innan du kan radera kontot.',
+          blockers: list,
+        },
+        { status: 409 }
       )
     }
 
-    return NextResponse.json({ success: true })
-  } catch (error) {
-    console.error('Account deletion error:', error)
+    log.error('anonymize_user_account failed', { userId: user.id, error: rpcError.message })
     return NextResponse.json(
       { error: 'Kunde inte radera kontot. Försök igen.' },
       { status: 500 }
     )
   }
+
+  // Wipe PII in auth.users metadata and ban the tombstone row ~100 years.
+  // DB functions can't reach supabase.auth.admin, so we do it here.
+  //
+  // Note: auth.users.email is intentionally NOT scrubbed. The original
+  // address is retained as a legitimate-interest tombstone so that:
+  //   (1) re-signup with the same email is blocked by Supabase's unique
+  //       constraint — deletion must feel permanent, not trivially
+  //       reversible by re-registering
+  //   (2) support can verify identity when a former user asks to recover
+  //       BFL-retained räkenskapsinformation
+  // This must be documented in the privacy policy under legitimate
+  // interest (GDPR Art. 6(1)(f)). The email is never read by the app
+  // after this point — login is impossible (row is banned) and the
+  // profile is anonymized, so no UI ever surfaces it.
+  //
+  // user_metadata / app_metadata ARE wiped — they may contain display
+  // name, avatar, or provider info that isn't needed for recovery.
+  // The admin API replaces (not merges) these, so passing {} clears them.
+  const service = createServiceClient()
+  try {
+    await service.auth.admin.updateUserById(user.id, {
+      user_metadata: {},
+      app_metadata: {},
+      ban_duration: '876000h',
+    })
+  } catch (err) {
+    log.error('Failed to wipe metadata and ban anonymized user', { userId: user.id, err })
+  }
+
+  try {
+    await service.auth.admin.signOut(user.id, 'global')
+  } catch (err) {
+    log.error('Failed to global sign out anonymized user', { userId: user.id, err })
+  }
+
+  const deletedAt = new Date().toISOString()
+  await eventBus.emit({
+    type: 'account.deleted',
+    payload: { userId: user.id, deletedAt },
+  })
+
+  // Best-effort: clear the caller's session cookie too.
+  await supabase.auth.signOut().catch(() => {})
+
+  // Request body is consumed; avoid unused-var lint.
+  void request
+
+  return NextResponse.json({ success: true })
 }
diff --git a/app/api/bookkeeping/accounts/[number]/route.ts b/app/api/bookkeeping/accounts/[number]/route.ts
index 8f81f364..e3114e6b 100644
--- a/app/api/bookkeeping/accounts/[number]/route.ts
+++ b/app/api/bookkeeping/accounts/[number]/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { UpdateAccountSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function DELETE(
   request: Request,
@@ -16,6 +17,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch the account to check if it's a system account
@@ -75,6 +79,9 @@ export async function PUT(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, UpdateAccountSchema)
diff --git a/app/api/bookkeeping/accounts/activate/route.ts b/app/api/bookkeeping/accounts/activate/route.ts
index 69d70ac3..a55dd1ed 100644
--- a/app/api/bookkeeping/accounts/activate/route.ts
+++ b/app/api/bookkeeping/accounts/activate/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { getBASReference } from '@/lib/bookkeeping/bas-reference'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * POST /api/bookkeeping/accounts/activate
@@ -18,6 +19,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body = await request.json()
diff --git a/app/api/bookkeeping/accounts/route.ts b/app/api/bookkeeping/accounts/route.ts
index 3a174184..23420b56 100644
--- a/app/api/bookkeeping/accounts/route.ts
+++ b/app/api/bookkeeping/accounts/route.ts
@@ -4,6 +4,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { CreateAccountSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET(request: Request) {
   const supabase = await createClient()
@@ -52,6 +53,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const validation = await validateBody(request, CreateAccountSchema)
   if (!validation.success) return validation.response
   const body = validation.data
diff --git a/app/api/bookkeeping/fiscal-periods/[id]/close/route.ts b/app/api/bookkeeping/fiscal-periods/[id]/close/route.ts
index b9cff5ec..9988395a 100644
--- a/app/api/bookkeeping/fiscal-periods/[id]/close/route.ts
+++ b/app/api/bookkeeping/fiscal-periods/[id]/close/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { closePeriod } from '@/lib/core/bookkeeping/period-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function POST(
   request: Request,
@@ -15,6 +16,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/bookkeeping/fiscal-periods/[id]/currency-revaluation/route.ts b/app/api/bookkeeping/fiscal-periods/[id]/currency-revaluation/route.ts
index 71b0b98a..4a373066 100644
--- a/app/api/bookkeeping/fiscal-periods/[id]/currency-revaluation/route.ts
+++ b/app/api/bookkeeping/fiscal-periods/[id]/currency-revaluation/route.ts
@@ -5,6 +5,7 @@ import {
   executeCurrencyRevaluation,
 } from '@/lib/bookkeeping/currency-revaluation'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * GET: Preview currency revaluation for a fiscal period
@@ -61,6 +62,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/bookkeeping/fiscal-periods/[id]/lock/route.ts b/app/api/bookkeeping/fiscal-periods/[id]/lock/route.ts
index 3512ed48..2a645725 100644
--- a/app/api/bookkeeping/fiscal-periods/[id]/lock/route.ts
+++ b/app/api/bookkeeping/fiscal-periods/[id]/lock/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { lockPeriod } from '@/lib/core/bookkeeping/period-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function POST(
   request: Request,
@@ -15,6 +16,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/bookkeeping/fiscal-periods/[id]/route.ts b/app/api/bookkeeping/fiscal-periods/[id]/route.ts
index ea5123ff..ac8082d7 100644
--- a/app/api/bookkeeping/fiscal-periods/[id]/route.ts
+++ b/app/api/bookkeeping/fiscal-periods/[id]/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { validatePeriodDuration } from '@/lib/bookkeeping/validate-period-duration'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import { z } from 'zod'
 
 const UpdateFiscalPeriodSchema = z.object({
@@ -23,6 +24,9 @@ export async function PATCH(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, UpdateFiscalPeriodSchema)
diff --git a/app/api/bookkeeping/fiscal-periods/[id]/year-end/route.ts b/app/api/bookkeeping/fiscal-periods/[id]/year-end/route.ts
index 8f6660a7..8238e187 100644
--- a/app/api/bookkeeping/fiscal-periods/[id]/year-end/route.ts
+++ b/app/api/bookkeeping/fiscal-periods/[id]/year-end/route.ts
@@ -6,6 +6,7 @@ import {
   executeYearEndClosing,
 } from '@/lib/core/bookkeeping/year-end-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * GET: Validate readiness and preview year-end closing
@@ -54,6 +55,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/bookkeeping/fiscal-periods/route.ts b/app/api/bookkeeping/fiscal-periods/route.ts
index d0e09b53..f36de63e 100644
--- a/app/api/bookkeeping/fiscal-periods/route.ts
+++ b/app/api/bookkeeping/fiscal-periods/route.ts
@@ -4,6 +4,7 @@ import { validatePeriodDuration } from '@/lib/bookkeeping/validate-period-durati
 import { validateBody } from '@/lib/api/validate'
 import { CreateFiscalPeriodSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET() {
   const supabase = await createClient()
@@ -36,6 +37,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, CreateFiscalPeriodSchema)
diff --git a/app/api/bookkeeping/journal-entries/[id]/correct/__tests__/route.test.ts b/app/api/bookkeeping/journal-entries/[id]/correct/__tests__/route.test.ts
index d28af8a0..0da2f518 100644
--- a/app/api/bookkeeping/journal-entries/[id]/correct/__tests__/route.test.ts
+++ b/app/api/bookkeeping/journal-entries/[id]/correct/__tests__/route.test.ts
@@ -17,6 +17,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 const mockCorrectEntry = vi.fn()
diff --git a/app/api/bookkeeping/journal-entries/[id]/correct/route.ts b/app/api/bookkeeping/journal-entries/[id]/correct/route.ts
index 79823ff1..6c8420fb 100644
--- a/app/api/bookkeeping/journal-entries/[id]/correct/route.ts
+++ b/app/api/bookkeeping/journal-entries/[id]/correct/route.ts
@@ -5,6 +5,7 @@ import { ensureInitialized } from '@/lib/init'
 import { validateBody } from '@/lib/api/validate'
 import { CorrectJournalEntrySchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -20,6 +21,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, CorrectJournalEntrySchema)
diff --git a/app/api/bookkeeping/journal-entries/[id]/reverse/__tests__/route.test.ts b/app/api/bookkeeping/journal-entries/[id]/reverse/__tests__/route.test.ts
index 2c61ddfc..cbc3d328 100644
--- a/app/api/bookkeeping/journal-entries/[id]/reverse/__tests__/route.test.ts
+++ b/app/api/bookkeeping/journal-entries/[id]/reverse/__tests__/route.test.ts
@@ -18,6 +18,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 const mockReverseEntry = vi.fn()
diff --git a/app/api/bookkeeping/journal-entries/[id]/reverse/route.ts b/app/api/bookkeeping/journal-entries/[id]/reverse/route.ts
index b243739b..c6b40c25 100644
--- a/app/api/bookkeeping/journal-entries/[id]/reverse/route.ts
+++ b/app/api/bookkeeping/journal-entries/[id]/reverse/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { reverseEntry } from '@/lib/bookkeeping/engine'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -18,6 +19,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/bookkeeping/journal-entries/__tests__/route.test.ts b/app/api/bookkeeping/journal-entries/__tests__/route.test.ts
index 9c8ed521..84982d03 100644
--- a/app/api/bookkeeping/journal-entries/__tests__/route.test.ts
+++ b/app/api/bookkeeping/journal-entries/__tests__/route.test.ts
@@ -18,6 +18,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 const mockCreateJournalEntry = vi.fn()
diff --git a/app/api/bookkeeping/journal-entries/route.ts b/app/api/bookkeeping/journal-entries/route.ts
index 7b9747c0..652400f1 100644
--- a/app/api/bookkeeping/journal-entries/route.ts
+++ b/app/api/bookkeeping/journal-entries/route.ts
@@ -5,6 +5,7 @@ import { ensureInitialized } from '@/lib/init'
 import { validateBody } from '@/lib/api/validate'
 import { CreateJournalEntrySchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -79,6 +80,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, CreateJournalEntrySchema)
diff --git a/app/api/bookkeeping/mapping-rules/route.ts b/app/api/bookkeeping/mapping-rules/route.ts
index 5d44ed2d..76f9dd3e 100644
--- a/app/api/bookkeeping/mapping-rules/route.ts
+++ b/app/api/bookkeeping/mapping-rules/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { CreateMappingRuleSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET() {
   const supabase = await createClient()
@@ -36,6 +37,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const result = await validateBody(request, CreateMappingRuleSchema)
diff --git a/app/api/bookkeeping/voucher-gaps/__tests__/route.test.ts b/app/api/bookkeeping/voucher-gaps/__tests__/route.test.ts
index be13fc27..d87fb01f 100644
--- a/app/api/bookkeeping/voucher-gaps/__tests__/route.test.ts
+++ b/app/api/bookkeeping/voucher-gaps/__tests__/route.test.ts
@@ -15,6 +15,11 @@ vi.mock('@/lib/supabase/server', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 import { GET, POST } from '../route'
diff --git a/app/api/bookkeeping/voucher-gaps/route.ts b/app/api/bookkeeping/voucher-gaps/route.ts
index aa0c454b..cfb56b06 100644
--- a/app/api/bookkeeping/voucher-gaps/route.ts
+++ b/app/api/bookkeeping/voucher-gaps/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody, validateQuery } from '@/lib/api/validate'
 import { VoucherGapQuerySchema, SaveGapExplanationSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET(request: Request) {
   const supabase = await createClient()
@@ -111,6 +112,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, SaveGapExplanationSchema)
diff --git a/app/api/calendar/feed/route.ts b/app/api/calendar/feed/route.ts
index 41b8ab55..aa0b577a 100644
--- a/app/api/calendar/feed/route.ts
+++ b/app/api/calendar/feed/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { UpdateCalendarFeedInput } from '@/types'
 
 /**
@@ -60,6 +61,9 @@ export async function POST() {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Check if feed already exists
@@ -117,6 +121,9 @@ export async function PUT(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body: UpdateCalendarFeedInput = await request.json()
@@ -156,6 +163,9 @@ export async function DELETE() {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Generate a new token by updating with a new UUID
diff --git a/app/api/company/[id]/delete/__tests__/route.test.ts b/app/api/company/[id]/delete/__tests__/route.test.ts
new file mode 100644
index 00000000..d1e31c21
--- /dev/null
+++ b/app/api/company/[id]/delete/__tests__/route.test.ts
@@ -0,0 +1,205 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createMockRequest, createMockRouteParams, parseJsonResponse } from '@/tests/helpers'
+import { eventBus } from '@/lib/events'
+
+vi.mock('@/lib/init', () => ({
+  ensureInitialized: vi.fn(),
+}))
+
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: vi.fn(),
+  createServiceClient: vi.fn(),
+}))
+
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: vi.fn(),
+}))
+
+import { createServiceClient } from '@/lib/supabase/server'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { POST } from '../route'
+
+const mockRequireAuth = vi.mocked(requireAuth)
+const mockCreateServiceClient = vi.mocked(createServiceClient)
+
+type Row = { data: unknown; error: unknown }
+
+function mockService(rowsByTable: Record<string, Row[]>) {
+  const insertSpy = vi.fn().mockResolvedValue({ data: null, error: null })
+  const updateSpies: Record<string, ReturnType<typeof vi.fn>> = {}
+
+  const from = vi.fn().mockImplementation((table: string) => {
+    const queue = rowsByTable[table] ?? []
+    const next = queue.shift() ?? { data: null, error: null }
+
+    const updateFn = vi.fn().mockReturnValue({
+      eq: vi.fn().mockReturnValue({
+        eq: vi.fn().mockResolvedValue({ data: null, error: null }),
+        then: (resolve: (v: unknown) => void) => resolve({ data: null, error: null }),
+      }),
+    })
+    updateSpies[table] = updateFn
+
+    return {
+      select: vi.fn().mockReturnValue({
+        eq: vi.fn().mockReturnValue({
+          eq: vi.fn().mockReturnValue({
+            maybeSingle: vi.fn().mockResolvedValue(next),
+          }),
+          maybeSingle: vi.fn().mockResolvedValue(next),
+        }),
+      }),
+      update: updateFn,
+      insert: insertSpy,
+    }
+  })
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  mockCreateServiceClient.mockReturnValue({ from } as any)
+  return { from, insertSpy, updateSpies }
+}
+
+function mockAuth(userId: string | null) {
+  if (userId) {
+    mockRequireAuth.mockResolvedValue({
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      user: { id: userId, email: 'u@example.com' } as any,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      supabase: {} as any,
+      error: null,
+    })
+  } else {
+    mockRequireAuth.mockResolvedValue({
+      user: null,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      supabase: {} as any,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      error: { status: 401 } as any,
+    })
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  eventBus.clear()
+})
+
+describe('POST /api/company/[id]/delete', () => {
+  it('returns 401 when unauthenticated', async () => {
+    mockAuth(null)
+    const req = createMockRequest('/api/company/c1/delete', {
+      method: 'POST',
+      body: { confirm_name: 'Acme' },
+    })
+    const res = await POST(req, createMockRouteParams({ id: 'c1' }))
+    // requireAuth already returned a NextResponse error
+    expect(res).toBeDefined()
+  })
+
+  it('returns 400 when confirm_name does not match', async () => {
+    mockAuth('user-1')
+    mockService({
+      companies: [{ data: { id: 'c1', name: 'Acme AB', archived_at: null }, error: null }],
+      company_members: [{ data: { role: 'owner' }, error: null }],
+    })
+
+    const req = createMockRequest('/api/company/c1/delete', {
+      method: 'POST',
+      body: { confirm_name: 'Wrong Name' },
+    })
+    const { status, body } = await parseJsonResponse(
+      await POST(req, createMockRouteParams({ id: 'c1' }))
+    )
+    expect(status).toBe(400)
+    expect(body).toHaveProperty('error')
+  })
+
+  it('returns 403 when caller is member but not owner', async () => {
+    mockAuth('user-1')
+    mockService({
+      companies: [{ data: { id: 'c1', name: 'Acme AB', archived_at: null }, error: null }],
+      company_members: [{ data: { role: 'member' }, error: null }],
+    })
+
+    const req = createMockRequest('/api/company/c1/delete', {
+      method: 'POST',
+      body: { confirm_name: 'Acme AB' },
+    })
+    const { status } = await parseJsonResponse(
+      await POST(req, createMockRouteParams({ id: 'c1' }))
+    )
+    expect(status).toBe(403)
+  })
+
+  it('returns 404 when company is already archived', async () => {
+    mockAuth('user-1')
+    mockService({
+      companies: [
+        {
+          data: {
+            id: 'c1',
+            name: 'Acme AB',
+            archived_at: '2026-01-01T00:00:00Z',
+          },
+          error: null,
+        },
+      ],
+    })
+
+    const req = createMockRequest('/api/company/c1/delete', {
+      method: 'POST',
+      body: { confirm_name: 'Acme AB' },
+    })
+    const { status } = await parseJsonResponse(
+      await POST(req, createMockRouteParams({ id: 'c1' }))
+    )
+    expect(status).toBe(404)
+  })
+
+  it('archives company, writes audit log, emits event on happy path', async () => {
+    mockAuth('user-1')
+    const { insertSpy, updateSpies } = mockService({
+      companies: [{ data: { id: 'c1', name: 'Acme AB', archived_at: null }, error: null }],
+      company_members: [{ data: { role: 'owner' }, error: null }],
+    })
+
+    const emitted: unknown[] = []
+    eventBus.on('company.deleted', (payload) => {
+      emitted.push(payload)
+    })
+
+    const req = createMockRequest('/api/company/c1/delete', {
+      method: 'POST',
+      body: { confirm_name: 'Acme AB' },
+    })
+    const { status, body } = await parseJsonResponse<{
+      data: { companyId: string; archivedAt: string }
+    }>(await POST(req, createMockRouteParams({ id: 'c1' })))
+
+    expect(status).toBe(200)
+    expect(body.data.companyId).toBe('c1')
+    expect(body.data.archivedAt).toBeTruthy()
+
+    // Verified the companies.update was called (archived_at + archived_by)
+    expect(updateSpies.companies).toHaveBeenCalledWith(
+      expect.objectContaining({
+        archived_at: expect.any(String),
+        archived_by: 'user-1',
+      })
+    )
+
+    // Audit log row written
+    expect(insertSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'DELETE',
+        table_name: 'companies',
+        record_id: 'c1',
+        user_id: 'user-1',
+      })
+    )
+
+    // Event emitted
+    expect(emitted).toHaveLength(1)
+    expect(emitted[0]).toMatchObject({ companyId: 'c1', userId: 'user-1' })
+  })
+})
diff --git a/app/api/company/[id]/delete/route.ts b/app/api/company/[id]/delete/route.ts
new file mode 100644
index 00000000..6e653c09
--- /dev/null
+++ b/app/api/company/[id]/delete/route.ts
@@ -0,0 +1,156 @@
+import { createServiceClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { ensureInitialized } from '@/lib/init'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { validateBody } from '@/lib/api/validate'
+import { eventBus } from '@/lib/events'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('api/company/delete')
+
+ensureInitialized()
+
+const DeleteCompanySchema = z.object({
+  confirm_name: z.string().min(1),
+})
+
+/**
+ * POST /api/company/[id]/delete
+ *
+ * Soft-delete a company. Sets archived_at + archived_by. The underlying
+ * bookkeeping data is retained for 7 years per BFL 7 kap. 2§. All reads
+ * flow through user_company_ids() which filters archived rows, so the
+ * company disappears from the user's UI immediately.
+ *
+ * Rules:
+ *  - Only callers with role='owner' in company_members may delete.
+ *  - The body must include confirm_name matching companies.name exactly.
+ *  - Already-archived companies return 404 (treated as not found).
+ */
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id: companyId } = await params
+
+  const auth = await requireAuth()
+  if (auth.error) return auth.error
+  const { user, supabase } = auth
+
+  const result = await validateBody(request, DeleteCompanySchema)
+  if (!result.success) return result.response
+  const { confirm_name } = result.data
+
+  // Service client for writes that must bypass RLS (audit_log insert,
+  // user_preferences clearing). All queries still filter by company_id
+  // and user.id for defense in depth.
+  const service = createServiceClient()
+
+  // 1. Fetch company — must exist and be active. Query via service client
+  // because we need the raw row regardless of RLS visibility, but we still
+  // enforce membership below.
+  const { data: company, error: fetchError } = await service
+    .from('companies')
+    .select('id, name, archived_at')
+    .eq('id', companyId)
+    .maybeSingle()
+
+  if (fetchError) {
+    log.error('Failed to fetch company', { companyId, error: fetchError.message })
+    return NextResponse.json({ error: 'Kunde inte hämta företag.' }, { status: 500 })
+  }
+
+  if (!company || company.archived_at) {
+    return NextResponse.json({ error: 'Företaget hittades inte.' }, { status: 404 })
+  }
+
+  // 2. Caller must be an owner of this company
+  const { data: membership, error: membershipError } = await service
+    .from('company_members')
+    .select('role')
+    .eq('company_id', companyId)
+    .eq('user_id', user.id)
+    .maybeSingle()
+
+  if (membershipError) {
+    log.error('Failed to fetch membership', { companyId, error: membershipError.message })
+    return NextResponse.json({ error: 'Kunde inte verifiera behörighet.' }, { status: 500 })
+  }
+
+  if (!membership) {
+    return NextResponse.json({ error: 'Företaget hittades inte.' }, { status: 404 })
+  }
+
+  if (membership.role !== 'owner') {
+    return NextResponse.json(
+      { error: 'Endast ägaren kan radera ett företag.' },
+      { status: 403 }
+    )
+  }
+
+  // 3. Confirm name matches exactly (case-sensitive trim)
+  if (confirm_name.trim() !== company.name.trim()) {
+    return NextResponse.json(
+      { error: 'Företagsnamnet stämmer inte överens.' },
+      { status: 400 }
+    )
+  }
+
+  // 4. Soft delete
+  const archivedAt = new Date().toISOString()
+  const { error: updateError } = await service
+    .from('companies')
+    .update({ archived_at: archivedAt, archived_by: user.id })
+    .eq('id', companyId)
+
+  if (updateError) {
+    log.error('Failed to archive company', { companyId, error: updateError.message })
+    return NextResponse.json({ error: 'Kunde inte radera företaget.' }, { status: 500 })
+  }
+
+  // 5. Clear user_preferences.active_company_id if it pointed here so the
+  // middleware falls through to another membership next request.
+  await service
+    .from('user_preferences')
+    .update({ active_company_id: null })
+    .eq('user_id', user.id)
+    .eq('active_company_id', companyId)
+
+  // 6. Write audit log row. companies has no auto-audit trigger, so do it
+  // explicitly. Service client bypasses audit_log RLS (no INSERT policy).
+  await service.from('audit_log').insert({
+    user_id: user.id,
+    company_id: companyId,
+    action: 'DELETE',
+    table_name: 'companies',
+    record_id: companyId,
+    actor_id: user.id,
+    old_state: { archived_at: null },
+    new_state: { archived_at: archivedAt, archived_by: user.id },
+    description: `Company archived: ${company.name}`,
+  })
+
+  // 7. Emit event
+  await eventBus.emit({
+    type: 'company.deleted',
+    payload: { companyId, userId: user.id, archivedAt },
+  })
+
+  // 8. Build response and clear company cookie if it matched
+  const response = NextResponse.json({ data: { companyId, archivedAt } })
+
+  const cookieCompanyId = request.headers.get('cookie')?.match(/gnubok-company-id=([^;]+)/)?.[1]
+  if (cookieCompanyId === companyId) {
+    response.cookies.set('gnubok-company-id', '', {
+      path: '/',
+      maxAge: 0,
+    })
+  }
+
+  // Ignore supabase server-client cookie warnings; the response is what
+  // the browser sees. RLS session isn't relevant here.
+  void supabase
+
+  return response
+}
diff --git a/app/api/company/current/route.ts b/app/api/company/current/route.ts
new file mode 100644
index 00000000..8f10f4d6
--- /dev/null
+++ b/app/api/company/current/route.ts
@@ -0,0 +1,36 @@
+import { createClient } from '@/lib/supabase/server'
+import { getActiveCompanyId } from '@/lib/company/context'
+import { NextResponse } from 'next/server'
+
+/**
+ * GET /api/company/current
+ *
+ * Returns the active company id for the authenticated user. Used by the
+ * client-side CompanyTabSync listener to detect cross-tab divergence (e.g.
+ * when a tab was hidden/backgrounded during a switch in another tab) and
+ * force a hard reload on mismatch.
+ *
+ * Never cached — the whole point is that the response reflects the current
+ * authoritative value in user_preferences.
+ */
+export async function GET() {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json(
+      { error: 'Unauthorized' },
+      {
+        status: 401,
+        headers: { 'Cache-Control': 'private, no-store' },
+      },
+    )
+  }
+
+  const companyId = await getActiveCompanyId(supabase, user.id)
+
+  return NextResponse.json(
+    { companyId },
+    { headers: { 'Cache-Control': 'private, no-store' } },
+  )
+}
diff --git a/app/api/company/members/[id]/route.ts b/app/api/company/members/[id]/route.ts
index fdb03257..d82ce09f 100644
--- a/app/api/company/members/[id]/route.ts
+++ b/app/api/company/members/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient, createServiceClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * DELETE /api/company/members/[id]
@@ -16,6 +17,9 @@ export async function DELETE(
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
   const { id: memberId } = await params
   const serviceClient = await createServiceClient()
diff --git a/app/api/company/members/invite/[id]/route.ts b/app/api/company/members/invite/[id]/route.ts
index d58691ff..75ec17bf 100644
--- a/app/api/company/members/invite/[id]/route.ts
+++ b/app/api/company/members/invite/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient, createServiceClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * DELETE /api/company/members/invite/[id]
@@ -15,6 +16,9 @@ export async function DELETE(
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
   const { id: inviteId } = await params
   const serviceClient = await createServiceClient()
diff --git a/app/api/company/members/invite/route.ts b/app/api/company/members/invite/route.ts
index a851383f..71840e43 100644
--- a/app/api/company/members/invite/route.ts
+++ b/app/api/company/members/invite/route.ts
@@ -1,6 +1,8 @@
 import { createClient, createServiceClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import { generateInviteToken, getInviteExpiry } from '@/lib/auth/invite-tokens'
 import { getEmailService } from '@/lib/email/service'
 import {
@@ -9,6 +11,12 @@ import {
   generateInviteEmailText,
 } from '@/lib/email/invite-templates'
 
+// Loads the email extension so getEmailService() returns the Resend
+// implementation instead of the noop default. Without this, the invite email
+// is silently skipped in dev whenever this route is hit before any other
+// init'd route in the process.
+ensureInitialized()
+
 /**
  * POST /api/company/members/invite
  * Invite a user to the current company (e.g., a client as viewer).
@@ -19,6 +27,9 @@ export async function POST(request: Request) {
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
   const serviceClient = await createServiceClient()
 
@@ -136,6 +147,12 @@ export async function POST(request: Request) {
       inviteUrl,
     }
 
+    console.log('[company/members/invite] sending email', {
+      to: email,
+      company: emailData.companyName,
+      from: user.email,
+    })
+
     const result = await emailService.sendEmail({
       to: email,
       subject: generateInviteEmailSubject(emailData),
@@ -143,9 +160,18 @@ export async function POST(request: Request) {
       text: generateInviteEmailText(emailData),
     })
 
-    if (!result.success) {
+    if (result.success) {
+      console.log('[company/members/invite] email sent', {
+        to: email,
+        messageId: result.messageId,
+      })
+    } else {
       console.error('[company/members/invite] email send failed:', result.error)
     }
+  } else {
+    console.warn('[company/members/invite] email service not configured — skipping send', {
+      to: email,
+    })
   }
 
   // In development, return the invite URL directly (no email service)
diff --git a/app/api/company/route.ts b/app/api/company/route.ts
new file mode 100644
index 00000000..10c77b41
--- /dev/null
+++ b/app/api/company/route.ts
@@ -0,0 +1,52 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+
+/**
+ * GET /api/company?owned=true&archived=false
+ *
+ * Returns companies the caller has access to, filtered by query:
+ *  - owned=true     → only companies where caller's role is 'owner'
+ *  - archived=false → only non-archived companies (default)
+ *
+ * Used by the account danger zone to show a blockers list before
+ * allowing account deletion.
+ */
+export async function GET(request: Request) {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const url = new URL(request.url)
+  const ownedOnly = url.searchParams.get('owned') === 'true'
+  const includeArchived = url.searchParams.get('archived') === 'true'
+
+  let query = supabase
+    .from('company_members')
+    .select('role, companies!inner(id, name, archived_at)')
+    .eq('user_id', user.id)
+
+  if (ownedOnly) query = query.eq('role', 'owner')
+  if (!includeArchived) query = query.is('companies.archived_at', null)
+
+  const { data, error } = await query
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  const companies = (data ?? []).map((row) => {
+    const company = (row.companies as unknown) as {
+      id: string
+      name: string
+      archived_at: string | null
+    }
+    return {
+      id: company.id,
+      name: company.name,
+      archived_at: company.archived_at,
+      role: row.role as string,
+    }
+  })
+
+  return NextResponse.json({ data: companies })
+}
diff --git a/app/api/customers/[id]/route.ts b/app/api/customers/[id]/route.ts
index 957ebbaf..82ad0ffd 100644
--- a/app/api/customers/[id]/route.ts
+++ b/app/api/customers/[id]/route.ts
@@ -4,6 +4,7 @@ import { validateBody } from '@/lib/api/validate'
 import { UpdateCustomerSchema } from '@/lib/api/schemas'
 import { validateVatNumber } from '@/lib/vat/vies-client'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import { createLogger } from '@/lib/logger'
 
 const log = createLogger('api/customers/[id]')
@@ -70,6 +71,9 @@ export async function PATCH(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const result = await validateBody(request, UpdateCustomerSchema)
@@ -172,6 +176,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { error, count } = await supabase
diff --git a/app/api/customers/__tests__/viewer.test.ts b/app/api/customers/__tests__/viewer.test.ts
new file mode 100644
index 00000000..c226853b
--- /dev/null
+++ b/app/api/customers/__tests__/viewer.test.ts
@@ -0,0 +1,87 @@
+/**
+ * Representative viewer-403 test.
+ *
+ * Verifies that POST /api/customers returns 403 when the caller's
+ * requireWritePermission check returns an error response. This is a
+ * canary test — if it breaks, the wiring between mutating routes and
+ * requireWritePermission has drifted.
+ *
+ * The full per-role behavior of requireWritePermission itself is
+ * covered in lib/auth/__tests__/require-write.test.ts.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { createMockRequest, parseJsonResponse } from '@/tests/helpers'
+
+const mockAuthGetUser = vi.fn()
+const mockFrom = vi.fn()
+const mockSupabase = {
+  auth: { getUser: mockAuthGetUser },
+  from: mockFrom,
+}
+
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: () => Promise.resolve(mockSupabase),
+}))
+
+vi.mock('@/lib/init', () => ({
+  ensureInitialized: vi.fn(),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+const requireWritePermissionMock = vi.fn()
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: (...args: unknown[]) => requireWritePermissionMock(...args),
+}))
+
+import { POST } from '../route'
+
+describe('POST /api/customers — viewer role gate', () => {
+  const mockUser = { id: 'user-1', email: 'viewer@test.se' }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockAuthGetUser.mockResolvedValue({ data: { user: mockUser } })
+  })
+
+  it('returns 403 with Swedish message when requireWritePermission rejects', async () => {
+    requireWritePermissionMock.mockResolvedValue({
+      ok: false,
+      response: NextResponse.json(
+        { error: 'Du har endast läsbehörighet i detta företag.' },
+        { status: 403 },
+      ),
+    })
+
+    const request = createMockRequest('/api/customers', {
+      method: 'POST',
+      body: { name: 'Test customer', customer_type: 'company' },
+    })
+
+    const response = await POST(request)
+    const { status, body } = await parseJsonResponse<{ error: string }>(response)
+
+    expect(status).toBe(403)
+    expect(body.error).toContain('läsbehörighet')
+  })
+
+  it('calls requireWritePermission with the authenticated user id', async () => {
+    requireWritePermissionMock.mockResolvedValue({
+      ok: false,
+      response: NextResponse.json({ error: 'blocked' }, { status: 403 }),
+    })
+
+    const request = createMockRequest('/api/customers', {
+      method: 'POST',
+      body: { name: 'Test customer', customer_type: 'company' },
+    })
+
+    await POST(request)
+
+    expect(requireWritePermissionMock).toHaveBeenCalledWith(mockSupabase, 'user-1')
+  })
+})
diff --git a/app/api/customers/route.ts b/app/api/customers/route.ts
index ed8b6e80..8bc7461a 100644
--- a/app/api/customers/route.ts
+++ b/app/api/customers/route.ts
@@ -6,6 +6,7 @@ import { validateBody } from '@/lib/api/validate'
 import { CreateCustomerSchema } from '@/lib/api/schemas'
 import { validateVatNumber } from '@/lib/vat/vies-client'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import { createLogger } from '@/lib/logger'
 import type { Customer } from '@/types'
 
@@ -46,6 +47,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const result = await validateBody(request, CreateCustomerSchema)
diff --git a/app/api/deadlines/[id]/complete/route.ts b/app/api/deadlines/[id]/complete/route.ts
index 06a7f49f..9d079385 100644
--- a/app/api/deadlines/[id]/complete/route.ts
+++ b/app/api/deadlines/[id]/complete/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * POST /api/deadlines/[id]/complete
@@ -21,6 +22,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // First, get current deadline state
diff --git a/app/api/deadlines/[id]/route.ts b/app/api/deadlines/[id]/route.ts
index e21a1c99..0285b55a 100644
--- a/app/api/deadlines/[id]/route.ts
+++ b/app/api/deadlines/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { CreateDeadlineInput } from '@/types'
 
 /**
@@ -60,6 +61,9 @@ export async function PUT(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body: Partial<CreateDeadlineInput> = await request.json()
@@ -124,6 +128,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { error } = await supabase
diff --git a/app/api/deadlines/[id]/status/route.ts b/app/api/deadlines/[id]/status/route.ts
index 514a1321..86360c01 100644
--- a/app/api/deadlines/[id]/status/route.ts
+++ b/app/api/deadlines/[id]/status/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { updateDeadlineStatus, isValidTransition } from '@/lib/deadlines/status-engine'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { DeadlineStatus } from '@/types'
 
 /**
@@ -20,6 +21,9 @@ export async function PATCH(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { id } = await params
diff --git a/app/api/deadlines/route.ts b/app/api/deadlines/route.ts
index 4faae8a7..828b0805 100644
--- a/app/api/deadlines/route.ts
+++ b/app/api/deadlines/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { CreateDeadlineSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * GET /api/deadlines
@@ -82,6 +83,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, CreateDeadlineSchema)
diff --git a/app/api/documents/[id]/link/route.ts b/app/api/documents/[id]/link/route.ts
index 802e688a..9407cf3b 100644
--- a/app/api/documents/[id]/link/route.ts
+++ b/app/api/documents/[id]/link/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { ensureInitialized } from '@/lib/init'
 import { linkToJournalEntry } from '@/lib/core/documents/document-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -26,6 +27,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { id } = await params
diff --git a/app/api/documents/[id]/verify/route.ts b/app/api/documents/[id]/verify/route.ts
index e72a5932..eef09825 100644
--- a/app/api/documents/[id]/verify/route.ts
+++ b/app/api/documents/[id]/verify/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { ensureInitialized } from '@/lib/init'
 import { verifyIntegrity } from '@/lib/core/documents/document-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -22,6 +23,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { id } = await params
diff --git a/app/api/documents/[id]/versions/route.ts b/app/api/documents/[id]/versions/route.ts
index 4a4c00d4..c8a2d4cc 100644
--- a/app/api/documents/[id]/versions/route.ts
+++ b/app/api/documents/[id]/versions/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { ensureInitialized } from '@/lib/init'
 import { createNewVersion, validateDocumentFile } from '@/lib/core/documents/document-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -25,6 +26,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { id } = await params
diff --git a/app/api/documents/match-sweep/route.ts b/app/api/documents/match-sweep/route.ts
index 59b884a8..cd8a1fe1 100644
--- a/app/api/documents/match-sweep/route.ts
+++ b/app/api/documents/match-sweep/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { runDocumentMatchingSweep } from '@/lib/documents/batch-match'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function POST(request: Request) {
   const supabase = await createClient()
@@ -11,6 +12,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Optional: pass specific inbox item IDs to match
diff --git a/app/api/documents/route.ts b/app/api/documents/route.ts
index b500b3ea..abd1f1e8 100644
--- a/app/api/documents/route.ts
+++ b/app/api/documents/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { ensureInitialized } from '@/lib/init'
 import { uploadDocument, validateDocumentFile } from '@/lib/core/documents/document-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -25,6 +26,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/extensions/[sector]/[slug]/data/route.ts b/app/api/extensions/[sector]/[slug]/data/route.ts
index 106ac12a..117d8271 100644
--- a/app/api/extensions/[sector]/[slug]/data/route.ts
+++ b/app/api/extensions/[sector]/[slug]/data/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET(
   request: Request,
@@ -56,6 +57,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body = await request.json()
@@ -101,6 +105,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { searchParams } = new URL(request.url)
diff --git a/app/api/extensions/[sector]/[slug]/settings/route.ts b/app/api/extensions/[sector]/[slug]/settings/route.ts
index aa2df852..1d8d5c7c 100644
--- a/app/api/extensions/[sector]/[slug]/settings/route.ts
+++ b/app/api/extensions/[sector]/[slug]/settings/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET(
   _request: Request,
@@ -41,6 +42,9 @@ export async function PATCH(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body = await request.json()
diff --git a/app/api/import/bank-file/execute/route.ts b/app/api/import/bank-file/execute/route.ts
index 23aec731..10380517 100644
--- a/app/api/import/bank-file/execute/route.ts
+++ b/app/api/import/bank-file/execute/route.ts
@@ -5,6 +5,7 @@ import { ensureInitialized } from '@/lib/init'
 import { ingestTransactions, type RawTransaction } from '@/lib/transactions/ingest'
 import { generateExternalId } from '@/lib/import/bank-file/parser'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { ParsedBankTransaction, BankFileFormatId } from '@/lib/import/bank-file/types'
 import type { Transaction } from '@/types'
 
@@ -34,6 +35,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body: ExecuteRequest = await request.json()
diff --git a/app/api/import/sie/[id]/route.ts b/app/api/import/sie/[id]/route.ts
index 8b30cc74..ade5adaa 100644
--- a/app/api/import/sie/[id]/route.ts
+++ b/app/api/import/sie/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * GET /api/import/sie/[id]
@@ -65,6 +66,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Check current status before deleting
diff --git a/app/api/import/sie/create-accounts/route.ts b/app/api/import/sie/create-accounts/route.ts
index 440ed3b3..23cda06e 100644
--- a/app/api/import/sie/create-accounts/route.ts
+++ b/app/api/import/sie/create-accounts/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { SIEAccount } from '@/lib/import/types'
 
 /**
@@ -64,6 +65,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/import/sie/execute/route.ts b/app/api/import/sie/execute/route.ts
index f441e1c0..82fac357 100644
--- a/app/api/import/sie/execute/route.ts
+++ b/app/api/import/sie/execute/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { fetchAllRows } from '@/lib/supabase/fetch-all'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import { parseSIEFile, detectEncoding, decodeBuffer } from '@/lib/import/sie-parser'
 import { suggestMappings } from '@/lib/import/account-mapper'
 import { executeSIEImport, checkDuplicateImport } from '@/lib/import/sie-import'
@@ -27,6 +28,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   try {
diff --git a/app/api/import/sie/mappings/route.ts b/app/api/import/sie/mappings/route.ts
index 5453c91c..3ffb70a0 100644
--- a/app/api/import/sie/mappings/route.ts
+++ b/app/api/import/sie/mappings/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { saveMappings } from '@/lib/import/sie-import'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { AccountMapping } from '@/lib/import/types'
 
 /**
@@ -49,6 +50,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body = await request.json()
@@ -84,6 +88,9 @@ export async function PUT(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const body = await request.json()
@@ -133,6 +140,9 @@ export async function DELETE(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { searchParams } = new URL(request.url)
diff --git a/app/api/invoices/[id]/convert/route.ts b/app/api/invoices/[id]/convert/route.ts
index 352dfb70..5800ecf9 100644
--- a/app/api/invoices/[id]/convert/route.ts
+++ b/app/api/invoices/[id]/convert/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { eventBus } from '@/lib/events'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { Invoice } from '@/types'
 
 ensureInitialized()
@@ -26,6 +27,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch proforma with items
diff --git a/app/api/invoices/[id]/mark-paid/__tests__/route.test.ts b/app/api/invoices/[id]/mark-paid/__tests__/route.test.ts
index ed802f3e..eda47208 100644
--- a/app/api/invoices/[id]/mark-paid/__tests__/route.test.ts
+++ b/app/api/invoices/[id]/mark-paid/__tests__/route.test.ts
@@ -19,6 +19,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 const mockCreateInvoicePaymentJournalEntry = vi.fn()
diff --git a/app/api/invoices/[id]/mark-paid/route.ts b/app/api/invoices/[id]/mark-paid/route.ts
index 7c6d247e..e8dac707 100644
--- a/app/api/invoices/[id]/mark-paid/route.ts
+++ b/app/api/invoices/[id]/mark-paid/route.ts
@@ -8,6 +8,7 @@ import { createJournalEntry, findFiscalPeriod } from '@/lib/bookkeeping/engine'
 import { MarkInvoicePaidSchema } from '@/lib/api/schemas'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { CreateJournalEntryInput, EntityType, Invoice } from '@/types'
 
 ensureInitialized()
@@ -36,6 +37,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch invoice
diff --git a/app/api/invoices/[id]/mark-sent/route.ts b/app/api/invoices/[id]/mark-sent/route.ts
index 189dcfae..9c41bd47 100644
--- a/app/api/invoices/[id]/mark-sent/route.ts
+++ b/app/api/invoices/[id]/mark-sent/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { createInvoiceJournalEntry } from '@/lib/bookkeeping/invoice-entries'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { EntityType, Invoice } from '@/types'
 
 ensureInitialized()
@@ -27,6 +28,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch invoice
diff --git a/app/api/invoices/[id]/route.ts b/app/api/invoices/[id]/route.ts
index 2dc601ef..d518e360 100644
--- a/app/api/invoices/[id]/route.ts
+++ b/app/api/invoices/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * DELETE /api/invoices/[id]
@@ -22,6 +23,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch invoice to verify ownership and status
diff --git a/app/api/invoices/[id]/send/__tests__/route.test.ts b/app/api/invoices/[id]/send/__tests__/route.test.ts
index 7bcc413f..48844841 100644
--- a/app/api/invoices/[id]/send/__tests__/route.test.ts
+++ b/app/api/invoices/[id]/send/__tests__/route.test.ts
@@ -24,6 +24,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 const mockRenderToBuffer = vi.fn()
 vi.mock('@react-pdf/renderer', () => ({
   renderToBuffer: (...args: unknown[]) => mockRenderToBuffer(...args),
diff --git a/app/api/invoices/[id]/send/route.ts b/app/api/invoices/[id]/send/route.ts
index a8772202..1c3e081b 100644
--- a/app/api/invoices/[id]/send/route.ts
+++ b/app/api/invoices/[id]/send/route.ts
@@ -13,6 +13,7 @@ import {
 import { createInvoiceJournalEntry } from '@/lib/bookkeeping/invoice-entries'
 import { uploadDocument } from '@/lib/core/documents/document-service'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { Invoice, InvoiceItem, Customer, CompanySettings } from '@/types'
 
 ensureInitialized()
@@ -30,6 +31,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Check if email is configured
diff --git a/app/api/invoices/__tests__/route.test.ts b/app/api/invoices/__tests__/route.test.ts
index 2da2932f..9b606e58 100644
--- a/app/api/invoices/__tests__/route.test.ts
+++ b/app/api/invoices/__tests__/route.test.ts
@@ -22,6 +22,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 const mockGetVatRules = vi.fn()
 const mockCalculateVat = vi.fn()
 const mockGetAvailableVatRates = vi.fn()
diff --git a/app/api/invoices/route.ts b/app/api/invoices/route.ts
index a491f1dc..ee8bca61 100644
--- a/app/api/invoices/route.ts
+++ b/app/api/invoices/route.ts
@@ -10,6 +10,7 @@ import {
   createCreditNoteJournalEntry,
 } from '@/lib/bookkeeping/invoice-entries'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -58,6 +59,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   let rawBody: unknown
diff --git a/app/api/kpi/preferences/route.ts b/app/api/kpi/preferences/route.ts
index b3932cf1..a3afc3eb 100644
--- a/app/api/kpi/preferences/route.ts
+++ b/app/api/kpi/preferences/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { mergeWithDefaults } from '@/lib/reports/kpi-definitions'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { KPIPreferences } from '@/types'
 
 const EXTENSION_ID = 'core/kpi'
@@ -31,6 +32,9 @@ export async function PUT(request: Request) {
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   let body: unknown
diff --git a/app/api/pending-operations/[id]/commit/__tests__/route.test.ts b/app/api/pending-operations/[id]/commit/__tests__/route.test.ts
index ca3427fc..41607fcc 100644
--- a/app/api/pending-operations/[id]/commit/__tests__/route.test.ts
+++ b/app/api/pending-operations/[id]/commit/__tests__/route.test.ts
@@ -20,6 +20,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 // Mock the counterparty templates (non-critical side effect)
 vi.mock('@/lib/bookkeeping/counterparty-templates', () => ({
   upsertCounterpartyTemplate: vi.fn().mockResolvedValue(undefined),
diff --git a/app/api/pending-operations/[id]/commit/route.ts b/app/api/pending-operations/[id]/commit/route.ts
index 17942a13..cea1df29 100644
--- a/app/api/pending-operations/[id]/commit/route.ts
+++ b/app/api/pending-operations/[id]/commit/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { eventBus } from '@/lib/events'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import { buildMappingResultFromCategory } from '@/lib/bookkeeping/category-mapping'
 import { createTransactionJournalEntry } from '@/lib/bookkeeping/transaction-entries'
 import { upsertCounterpartyTemplate } from '@/lib/bookkeeping/counterparty-templates'
@@ -792,6 +793,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch the pending operation
diff --git a/app/api/pending-operations/[id]/reject/__tests__/route.test.ts b/app/api/pending-operations/[id]/reject/__tests__/route.test.ts
index a779c591..53662d05 100644
--- a/app/api/pending-operations/[id]/reject/__tests__/route.test.ts
+++ b/app/api/pending-operations/[id]/reject/__tests__/route.test.ts
@@ -16,6 +16,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 import { POST } from '../../reject/route'
 
 describe('POST /api/pending-operations/:id/reject', () => {
diff --git a/app/api/pending-operations/[id]/reject/route.ts b/app/api/pending-operations/[id]/reject/route.ts
index f2a7a8f4..52d7789b 100644
--- a/app/api/pending-operations/[id]/reject/route.ts
+++ b/app/api/pending-operations/[id]/reject/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * POST /api/pending-operations/:id/reject
@@ -19,6 +20,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { data: op, error: fetchError } = await supabase
diff --git a/app/api/reconciliation/bank/link/route.ts b/app/api/reconciliation/bank/link/route.ts
index a767110c..b620f508 100644
--- a/app/api/reconciliation/bank/link/route.ts
+++ b/app/api/reconciliation/bank/link/route.ts
@@ -5,6 +5,7 @@ import { manualLink } from '@/lib/reconciliation/bank-reconciliation'
 import { validateBody } from '@/lib/api/validate'
 import { BankLinkSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -16,6 +17,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, BankLinkSchema)
diff --git a/app/api/reconciliation/bank/run/route.ts b/app/api/reconciliation/bank/run/route.ts
index c808202f..aac0be02 100644
--- a/app/api/reconciliation/bank/run/route.ts
+++ b/app/api/reconciliation/bank/run/route.ts
@@ -5,6 +5,7 @@ import { runReconciliation } from '@/lib/reconciliation/bank-reconciliation'
 import { validateBody } from '@/lib/api/validate'
 import { RunReconciliationSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -16,6 +17,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, RunReconciliationSchema)
diff --git a/app/api/reconciliation/bank/unlink/route.ts b/app/api/reconciliation/bank/unlink/route.ts
index 6a0cd16e..f66d1091 100644
--- a/app/api/reconciliation/bank/unlink/route.ts
+++ b/app/api/reconciliation/bank/unlink/route.ts
@@ -4,6 +4,7 @@ import { unlinkReconciliation } from '@/lib/reconciliation/bank-reconciliation'
 import { validateBody } from '@/lib/api/validate'
 import { BankUnlinkSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function POST(request: Request) {
   const supabase = await createClient()
@@ -13,6 +14,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, BankUnlinkSchema)
diff --git a/app/api/settings/api-keys/[id]/route.ts b/app/api/settings/api-keys/[id]/route.ts
index 0d0e0e6d..6b11f7ac 100644
--- a/app/api/settings/api-keys/[id]/route.ts
+++ b/app/api/settings/api-keys/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * DELETE /api/settings/api-keys/[id] — Revoke an API key (soft delete)
@@ -17,6 +18,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { error } = await supabase
diff --git a/app/api/settings/api-keys/route.ts b/app/api/settings/api-keys/route.ts
index 3dae6b34..25121bcf 100644
--- a/app/api/settings/api-keys/route.ts
+++ b/app/api/settings/api-keys/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { generateApiKey, hashApiKey, DEFAULT_SCOPES, validateScopes } from '@/lib/auth/api-keys'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { ApiKeyScope } from '@/lib/auth/api-keys'
 
 /**
@@ -42,6 +43,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   let name = 'Unnamed key'
diff --git a/app/api/settings/counterparty-templates/route.ts b/app/api/settings/counterparty-templates/route.ts
index 739c7587..b9220a6a 100644
--- a/app/api/settings/counterparty-templates/route.ts
+++ b/app/api/settings/counterparty-templates/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET() {
   const supabase = await createClient()
@@ -26,6 +27,9 @@ export async function DELETE(request: Request) {
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   let id: string | undefined
diff --git a/app/api/settings/logo/route.ts b/app/api/settings/logo/route.ts
index 9e2a0a49..ad12a865 100644
--- a/app/api/settings/logo/route.ts
+++ b/app/api/settings/logo/route.ts
@@ -1,6 +1,7 @@
 import { createClient, createServiceClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 const MAX_SIZE = 2 * 1024 * 1024 // 2MB
 const ALLOWED_TYPES = ['image/png', 'image/jpeg', 'image/svg+xml', 'image/webp']
@@ -10,6 +11,9 @@ export async function POST(request: Request) {
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
   if (!companyId) return NextResponse.json({ error: 'No company' }, { status: 403 })
 
@@ -68,6 +72,9 @@ export async function DELETE() {
   const { data: { user } } = await supabase.auth.getUser()
   if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
   if (!companyId) return NextResponse.json({ error: 'No company' }, { status: 403 })
 
diff --git a/app/api/settings/route.ts b/app/api/settings/route.ts
index 3a82d0cf..5838e3aa 100644
--- a/app/api/settings/route.ts
+++ b/app/api/settings/route.ts
@@ -4,6 +4,7 @@ import { didTaxFieldsChange, regenerateTaxDeadlinesForUser } from '@/lib/tax/dea
 import { validateBody } from '@/lib/api/validate'
 import { UpdateSettingsSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET() {
   const supabase = await createClient()
@@ -51,6 +52,9 @@ export async function PUT(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch current settings to check for tax-relevant changes
diff --git a/app/api/supplier-invoices/[id]/approve/__tests__/route.test.ts b/app/api/supplier-invoices/[id]/approve/__tests__/route.test.ts
index 0cde102e..1be6d075 100644
--- a/app/api/supplier-invoices/[id]/approve/__tests__/route.test.ts
+++ b/app/api/supplier-invoices/[id]/approve/__tests__/route.test.ts
@@ -21,6 +21,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 import { eventBus } from '@/lib/events'
 
 import { POST } from '../route'
diff --git a/app/api/supplier-invoices/[id]/approve/route.ts b/app/api/supplier-invoices/[id]/approve/route.ts
index 151c70e7..06fd61e5 100644
--- a/app/api/supplier-invoices/[id]/approve/route.ts
+++ b/app/api/supplier-invoices/[id]/approve/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { eventBus } from '@/lib/events'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { SupplierInvoice } from '@/types'
 
 ensureInitialized()
@@ -20,6 +21,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { data: invoice } = await supabase
diff --git a/app/api/supplier-invoices/[id]/credit/route.ts b/app/api/supplier-invoices/[id]/credit/route.ts
index 4ac2e811..035cf0e4 100644
--- a/app/api/supplier-invoices/[id]/credit/route.ts
+++ b/app/api/supplier-invoices/[id]/credit/route.ts
@@ -4,6 +4,7 @@ import { eventBus } from '@/lib/events'
 import { ensureInitialized } from '@/lib/init'
 import { createSupplierCreditNoteEntry } from '@/lib/bookkeeping/supplier-invoice-entries'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { SupplierInvoice, SupplierInvoiceItem, AccountingMethod } from '@/types'
 
 ensureInitialized()
@@ -21,6 +22,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch original invoice with supplier and items
diff --git a/app/api/supplier-invoices/[id]/mark-paid/__tests__/route.test.ts b/app/api/supplier-invoices/[id]/mark-paid/__tests__/route.test.ts
index e065d43d..08b3e66c 100644
--- a/app/api/supplier-invoices/[id]/mark-paid/__tests__/route.test.ts
+++ b/app/api/supplier-invoices/[id]/mark-paid/__tests__/route.test.ts
@@ -22,6 +22,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 const mockCreateSupplierInvoicePaymentEntry = vi.fn()
 const mockCreateSupplierInvoiceCashEntry = vi.fn()
 vi.mock('@/lib/bookkeeping/supplier-invoice-entries', () => ({
diff --git a/app/api/supplier-invoices/[id]/mark-paid/route.ts b/app/api/supplier-invoices/[id]/mark-paid/route.ts
index 73ed2009..f3be114f 100644
--- a/app/api/supplier-invoices/[id]/mark-paid/route.ts
+++ b/app/api/supplier-invoices/[id]/mark-paid/route.ts
@@ -9,6 +9,7 @@ import {
 import { validateBody } from '@/lib/api/validate'
 import { MarkSupplierInvoicePaidSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { SupplierInvoice, SupplierInvoiceItem } from '@/types'
 
 ensureInitialized()
@@ -26,6 +27,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, MarkSupplierInvoicePaidSchema)
diff --git a/app/api/supplier-invoices/[id]/route.ts b/app/api/supplier-invoices/[id]/route.ts
index 72f01894..8994a071 100644
--- a/app/api/supplier-invoices/[id]/route.ts
+++ b/app/api/supplier-invoices/[id]/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { UpdateSupplierInvoiceSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET(
   _request: Request,
@@ -46,6 +47,9 @@ export async function PUT(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Only allow editing registered invoices
@@ -99,6 +103,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Only allow deleting registered invoices without journal entries
diff --git a/app/api/supplier-invoices/__tests__/route.test.ts b/app/api/supplier-invoices/__tests__/route.test.ts
index a35312ba..dadfa482 100644
--- a/app/api/supplier-invoices/__tests__/route.test.ts
+++ b/app/api/supplier-invoices/__tests__/route.test.ts
@@ -21,6 +21,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 const mockFindFiscalPeriod = vi.fn()
 vi.mock('@/lib/bookkeeping/engine', () => ({
   findFiscalPeriod: (...args: unknown[]) => mockFindFiscalPeriod(...args),
diff --git a/app/api/supplier-invoices/route.ts b/app/api/supplier-invoices/route.ts
index 9c4f4459..c3059f55 100644
--- a/app/api/supplier-invoices/route.ts
+++ b/app/api/supplier-invoices/route.ts
@@ -6,6 +6,7 @@ import { ensureInitialized } from '@/lib/init'
 import { validateBody } from '@/lib/api/validate'
 import { CreateSupplierInvoiceSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { SupplierInvoice, SupplierInvoiceItem } from '@/types'
 
 ensureInitialized()
@@ -55,6 +56,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, CreateSupplierInvoiceSchema)
diff --git a/app/api/suppliers/[id]/route.ts b/app/api/suppliers/[id]/route.ts
index 9009f918..09a06677 100644
--- a/app/api/suppliers/[id]/route.ts
+++ b/app/api/suppliers/[id]/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { UpdateSupplierSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET(
   _request: Request,
@@ -70,6 +71,9 @@ export async function PUT(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const result = await validateBody(request, UpdateSupplierSchema)
@@ -125,6 +129,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Check for linked invoices
diff --git a/app/api/suppliers/route.ts b/app/api/suppliers/route.ts
index 6985bbcf..90b59b64 100644
--- a/app/api/suppliers/route.ts
+++ b/app/api/suppliers/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { validateBody } from '@/lib/api/validate'
 import { CreateSupplierSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function GET() {
   const supabase = await createClient()
@@ -37,6 +38,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const result = await validateBody(request, CreateSupplierSchema)
diff --git a/app/api/tax-deadlines/generate/route.ts b/app/api/tax-deadlines/generate/route.ts
index 34ff35e7..ee3fd413 100644
--- a/app/api/tax-deadlines/generate/route.ts
+++ b/app/api/tax-deadlines/generate/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { regenerateTaxDeadlinesForUser } from '@/lib/tax/deadline-generator'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 /**
  * POST /api/tax-deadlines/generate
@@ -16,6 +17,9 @@ export async function POST() {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch company settings
diff --git a/app/api/transactions/[id]/__tests__/route.test.ts b/app/api/transactions/[id]/__tests__/route.test.ts
index 9ac4e6ad..421569c1 100644
--- a/app/api/transactions/[id]/__tests__/route.test.ts
+++ b/app/api/transactions/[id]/__tests__/route.test.ts
@@ -13,6 +13,11 @@ vi.mock('@/lib/supabase/server', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 import { DELETE } from '../route'
diff --git a/app/api/transactions/[id]/book/__tests__/route.test.ts b/app/api/transactions/[id]/book/__tests__/route.test.ts
index 3d75ea05..20e48fbb 100644
--- a/app/api/transactions/[id]/book/__tests__/route.test.ts
+++ b/app/api/transactions/[id]/book/__tests__/route.test.ts
@@ -20,6 +20,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 const mockCreateJournalEntry = vi.fn()
diff --git a/app/api/transactions/[id]/book/route.ts b/app/api/transactions/[id]/book/route.ts
index f2a2a057..8b4fe239 100644
--- a/app/api/transactions/[id]/book/route.ts
+++ b/app/api/transactions/[id]/book/route.ts
@@ -6,6 +6,7 @@ import { createJournalEntry } from '@/lib/bookkeeping/engine'
 import { validateBody } from '@/lib/api/validate'
 import { BookTransactionSchema } from '@/lib/api/schemas'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { Transaction } from '@/types'
 
 ensureInitialized()
@@ -23,6 +24,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, BookTransactionSchema)
diff --git a/app/api/transactions/[id]/categorize/__tests__/route.test.ts b/app/api/transactions/[id]/categorize/__tests__/route.test.ts
index cdff8a3a..7e9ab1ac 100644
--- a/app/api/transactions/[id]/categorize/__tests__/route.test.ts
+++ b/app/api/transactions/[id]/categorize/__tests__/route.test.ts
@@ -22,6 +22,10 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
 const mockBuildMappingResultFromCategory = vi.fn()
 vi.mock('@/lib/bookkeeping/category-mapping', () => ({
   buildMappingResultFromCategory: (...args: unknown[]) =>
diff --git a/app/api/transactions/[id]/categorize/route.ts b/app/api/transactions/[id]/categorize/route.ts
index d961eaeb..f674b41a 100644
--- a/app/api/transactions/[id]/categorize/route.ts
+++ b/app/api/transactions/[id]/categorize/route.ts
@@ -8,6 +8,7 @@ import { createTransactionJournalEntry } from '@/lib/bookkeeping/transaction-ent
 import { saveUserMappingRule } from '@/lib/bookkeeping/mapping-engine'
 import { upsertCounterpartyTemplate, buildMappingResultFromCounterpartyTemplate } from '@/lib/bookkeeping/counterparty-templates'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { CategorizationTemplate } from '@/types'
 import { validateBody } from '@/lib/api/validate'
 import { CategorizeTransactionSchema } from '@/lib/api/schemas'
@@ -99,6 +100,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Parse and validate request body
diff --git a/app/api/transactions/[id]/match-invoice/__tests__/route.test.ts b/app/api/transactions/[id]/match-invoice/__tests__/route.test.ts
index 4b3facef..cc107c01 100644
--- a/app/api/transactions/[id]/match-invoice/__tests__/route.test.ts
+++ b/app/api/transactions/[id]/match-invoice/__tests__/route.test.ts
@@ -42,6 +42,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 import { POST } from '../route'
diff --git a/app/api/transactions/[id]/match-invoice/route.ts b/app/api/transactions/[id]/match-invoice/route.ts
index 4ebd6dcd..a480bfb8 100644
--- a/app/api/transactions/[id]/match-invoice/route.ts
+++ b/app/api/transactions/[id]/match-invoice/route.ts
@@ -11,6 +11,7 @@ import { logMatchEvent } from '@/lib/invoices/match-log'
 import { eventBus } from '@/lib/events/bus'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { EntityType, Invoice, Transaction } from '@/types'
 
 ensureInitialized()
@@ -40,6 +41,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Parse and validate request body
diff --git a/app/api/transactions/[id]/match-supplier-invoice/route.ts b/app/api/transactions/[id]/match-supplier-invoice/route.ts
index 27be3275..26c57d2a 100644
--- a/app/api/transactions/[id]/match-supplier-invoice/route.ts
+++ b/app/api/transactions/[id]/match-supplier-invoice/route.ts
@@ -10,6 +10,7 @@ import { logMatchEvent } from '@/lib/invoices/match-log'
 import { eventBus } from '@/lib/events/bus'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { SupplierInvoice, SupplierInvoiceItem, Transaction } from '@/types'
 
 ensureInitialized()
@@ -32,6 +33,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const validation = await validateBody(request, MatchSupplierInvoiceSchema)
diff --git a/app/api/transactions/[id]/route.ts b/app/api/transactions/[id]/route.ts
index 7ea3e32a..408b773c 100644
--- a/app/api/transactions/[id]/route.ts
+++ b/app/api/transactions/[id]/route.ts
@@ -1,6 +1,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 export async function DELETE(
   _request: Request,
@@ -14,6 +15,9 @@ export async function DELETE(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch the transaction with ownership check
diff --git a/app/api/transactions/[id]/uncategorize/__tests__/route.test.ts b/app/api/transactions/[id]/uncategorize/__tests__/route.test.ts
index d40e67f5..495d1629 100644
--- a/app/api/transactions/[id]/uncategorize/__tests__/route.test.ts
+++ b/app/api/transactions/[id]/uncategorize/__tests__/route.test.ts
@@ -18,6 +18,11 @@ vi.mock('@/lib/init', () => ({
 
 vi.mock('@/lib/company/context', () => ({
   requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
 }))
 
 const mockReverseEntry = vi.fn()
diff --git a/app/api/transactions/[id]/uncategorize/route.ts b/app/api/transactions/[id]/uncategorize/route.ts
index b5d6538e..cb5f9063 100644
--- a/app/api/transactions/[id]/uncategorize/route.ts
+++ b/app/api/transactions/[id]/uncategorize/route.ts
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { reverseEntry } from '@/lib/bookkeeping/engine'
 import { ensureInitialized } from '@/lib/init'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 
 ensureInitialized()
 
@@ -16,6 +17,9 @@ export async function POST(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   const { id } = await params
diff --git a/app/api/transactions/batch-match-invoices/route.ts b/app/api/transactions/batch-match-invoices/route.ts
index ce7bbf1c..56359a3e 100644
--- a/app/api/transactions/batch-match-invoices/route.ts
+++ b/app/api/transactions/batch-match-invoices/route.ts
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { getBestInvoiceMatch } from '@/lib/invoices/invoice-matching'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireWritePermission } from '@/lib/auth/require-write'
 import type { Transaction } from '@/types'
 
 /**
@@ -17,6 +18,9 @@ export async function POST() {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
+  const writeCheck = await requireWritePermission(supabase, user.id)
+  if (!writeCheck.ok) return writeCheck.response
+
   const companyId = await requireCompanyId(supabase, user.id)
 
   // Fetch uncategorized income transactions without a potential match
diff --git a/app/invite/[token]/page.tsx b/app/invite/[token]/page.tsx
index cbe1f219..3f667b74 100644
--- a/app/invite/[token]/page.tsx
+++ b/app/invite/[token]/page.tsx
@@ -7,6 +7,8 @@ import Link from 'next/link'
 import { Button } from '@/components/ui/button'
 import { Card } from '@/components/ui/card'
 import { Loader2, Building2, AlertCircle } from 'lucide-react'
+import { createClient } from '@/lib/supabase/client'
+import { useToast } from '@/components/ui/use-toast'
 
 interface InviteInfo {
   type: 'company'
@@ -19,24 +21,36 @@ interface InviteInfo {
 export default function InvitePage() {
   const params = useParams()
   const router = useRouter()
+  const { toast } = useToast()
   const token = params.token as string
 
   const [isLoading, setIsLoading] = useState(true)
   const [error, setError] = useState<string | null>(null)
   const [invite, setInvite] = useState<InviteInfo | null>(null)
+  // Email of the currently signed-in user (if any). Used to short-circuit
+  // the login redirect for users who are already authenticated.
+  const [currentUserEmail, setCurrentUserEmail] = useState<string | null>(null)
+  const [isJoining, setIsJoining] = useState(false)
 
   useEffect(() => {
     async function loadInvite() {
       try {
-        const res = await fetch(`/api/team/accept?token=${encodeURIComponent(token)}`)
-        const data = await res.json()
+        // Load invite info and current session in parallel — the page needs
+        // both to decide which CTA to render.
+        const supabase = createClient()
+        const [inviteRes, sessionRes] = await Promise.all([
+          fetch(`/api/team/accept?token=${encodeURIComponent(token)}`),
+          supabase.auth.getUser(),
+        ])
 
-        if (!res.ok) {
+        const data = await inviteRes.json()
+        if (!inviteRes.ok) {
           setError(data.error || 'Inbjudan är ogiltig.')
           return
         }
 
         setInvite(data.data)
+        setCurrentUserEmail(sessionRes.data.user?.email ?? null)
       } catch {
         setError('Kunde inte ladda inbjudan.')
       } finally {
@@ -48,6 +62,18 @@ export default function InvitePage() {
 
   const secureCookieFlag = typeof window !== 'undefined' && window.location.protocol === 'https:' ? '; secure' : ''
 
+  // True when the signed-in user's email matches the invite — in that case
+  // we can accept the invite with a single click, no re-login required.
+  const isLoggedInAsInvitee =
+    !!currentUserEmail &&
+    !!invite &&
+    currentUserEmail.toLowerCase() === invite.email.toLowerCase()
+
+  // True when someone is signed in but with a different email than the
+  // invite is for. They need to sign out first.
+  const isLoggedInAsOther =
+    !!currentUserEmail && !!invite && !isLoggedInAsInvitee
+
   const handleAccept = () => {
     // Store invite token in cookie before redirecting to register
     document.cookie = `gnubok-invite-token=${token}; path=/; max-age=3600; samesite=lax${secureCookieFlag}`
@@ -60,6 +86,58 @@ export default function InvitePage() {
     router.push('/login')
   }
 
+  // Already signed in as the invitee — accept directly, no login detour.
+  // POST /api/team/accept handles the membership insert + sets the active
+  // company; we then full-reload to '/' so middleware picks up the new
+  // company context and the switcher shows it.
+  const handleJoinNow = async () => {
+    setIsJoining(true)
+    try {
+      const res = await fetch('/api/team/accept', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token }),
+      })
+      const body = await res.json().catch(() => ({}))
+
+      if (!res.ok) {
+        toast({
+          title: 'Kunde inte gå med',
+          description: body.error || 'Ett oväntat fel uppstod. Försök igen.',
+          variant: 'destructive',
+        })
+        setIsJoining(false)
+        return
+      }
+
+      toast({
+        title: 'Välkommen!',
+        description: invite?.companyName
+          ? `Du är nu medlem i ${invite.companyName}.`
+          : 'Du är nu medlem.',
+      })
+      // Full reload so the middleware re-resolves company context from the
+      // updated user_preferences.active_company_id.
+      window.location.href = '/'
+    } catch (err) {
+      console.error('[invite] join failed:', err)
+      toast({
+        title: 'Kunde inte gå med',
+        description: 'Ett oväntat fel uppstod. Försök igen.',
+        variant: 'destructive',
+      })
+      setIsJoining(false)
+    }
+  }
+
+  const handleSignOutAndRetry = async () => {
+    const supabase = createClient()
+    await supabase.auth.signOut()
+    // Keep the invite cookie alive so the next login/register picks it up.
+    document.cookie = `gnubok-invite-token=${token}; path=/; max-age=3600; samesite=lax${secureCookieFlag}`
+    router.push('/login')
+  }
+
   if (isLoading) {
     return (
       <div className="min-h-screen flex items-center justify-center bg-background">
@@ -131,7 +209,70 @@ export default function InvitePage() {
                   </div>
                 </div>
               </Card>
+            ) : invite?.alreadyHasAccount && isLoggedInAsInvitee ? (
+              // Already signed in as the invitee — one-click join.
+              <div className="space-y-6">
+                <Card className="p-6">
+                  <div className="flex items-start gap-4">
+                    <div className="p-2.5 rounded-lg bg-muted/50">
+                      <Building2 className="h-5 w-5 text-muted-foreground" />
+                    </div>
+                    <div>
+                      <p className="font-medium">{invite.companyName}</p>
+                      <p className="text-sm text-muted-foreground mt-0.5">
+                        Du har bjudits in som medlem till detta företag.
+                      </p>
+                      <p className="text-sm text-muted-foreground mt-1">
+                        Inloggad som <strong>{currentUserEmail}</strong>.
+                      </p>
+                    </div>
+                  </div>
+                </Card>
+
+                <Button
+                  size="lg"
+                  className="w-full"
+                  onClick={handleJoinNow}
+                  disabled={isJoining}
+                >
+                  {isJoining ? (
+                    <>
+                      <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                      Går med…
+                    </>
+                  ) : (
+                    <>Gå med i {invite.companyName}</>
+                  )}
+                </Button>
+              </div>
+            ) : invite?.alreadyHasAccount && isLoggedInAsOther ? (
+              // Signed in as a different user — ask them to sign out first.
+              <div className="space-y-6">
+                <Card className="p-6">
+                  <div className="flex items-start gap-4">
+                    <div className="p-2.5 rounded-lg bg-muted/50">
+                      <Building2 className="h-5 w-5 text-muted-foreground" />
+                    </div>
+                    <div>
+                      <p className="font-medium">{invite.companyName}</p>
+                      <p className="text-sm text-muted-foreground mt-0.5">
+                        Inbjudan är skickad till <strong>{invite.email}</strong>, men
+                        du är inloggad som <strong>{currentUserEmail}</strong>.
+                      </p>
+                      <p className="text-sm text-muted-foreground mt-1">
+                        Logga ut och logga in igen med rätt konto för att gå med.
+                      </p>
+                    </div>
+                  </div>
+                </Card>
+
+                <Button size="lg" className="w-full" onClick={handleSignOutAndRetry}>
+                  Logga ut och byt konto
+                </Button>
+              </div>
             ) : invite?.alreadyHasAccount ? (
+              // Not signed in yet — current behavior: bounce to /login with
+              // the invite cookie.
               <div className="space-y-6">
                 <Card className="p-6">
                   <div className="flex items-start gap-4">
diff --git a/components/bookkeeping/JournalEntryForm.tsx b/components/bookkeeping/JournalEntryForm.tsx
index 5c758764..0bb227e7 100644
--- a/components/bookkeeping/JournalEntryForm.tsx
+++ b/components/bookkeeping/JournalEntryForm.tsx
@@ -7,7 +7,8 @@ import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
 import { useToast } from '@/components/ui/use-toast'
-import { Plus, Trash2, AlertTriangle, Loader2 } from 'lucide-react'
+import { Plus, Trash2, AlertTriangle, Loader2, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import { ConfirmationDialog } from '@/components/ui/confirmation-dialog'
 import { JournalEntryReviewContent } from '@/components/bookkeeping/JournalEntryReviewContent'
 import DocumentUploadZone from '@/components/bookkeeping/DocumentUploadZone'
@@ -62,6 +63,7 @@ export default function JournalEntryForm({
   submitUrl,
   embedded,
 }: Props) {
+  const { canWrite } = useCanWrite()
   const { toast } = useToast()
   const [periods, setPeriods] = useState<FiscalPeriod[]>([])
   const [selectedPeriod, setSelectedPeriod] = useState('')
@@ -615,8 +617,10 @@ export default function JournalEntryForm({
       <div className="flex flex-col items-end gap-1">
         <Button
           onClick={handleReview}
-          disabled={!isBalanced || !description || !selectedPeriod || isSubmitting || isUploading}
+          disabled={!isBalanced || !description || !selectedPeriod || isSubmitting || isUploading || !canWrite}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
         >
+          {!canWrite && <Lock className="mr-2 h-4 w-4" />}
           Granska & skapa
         </Button>
         {(!description || !selectedPeriod || isUploading) && (
diff --git a/components/customers/CustomerForm.tsx b/components/customers/CustomerForm.tsx
index 97914007..7c771626 100644
--- a/components/customers/CustomerForm.tsx
+++ b/components/customers/CustomerForm.tsx
@@ -10,7 +10,8 @@ import { Label } from '@/components/ui/label'
 import { Textarea } from '@/components/ui/textarea'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
 import { useToast } from '@/components/ui/use-toast'
-import { Loader2, CheckCircle, XCircle } from 'lucide-react'
+import { Loader2, CheckCircle, XCircle, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { CreateCustomerInput, CustomerType } from '@/types'
 
 const schema = z.object({
@@ -42,6 +43,7 @@ export default function CustomerForm({
   isLoading,
   initialData,
 }: CustomerFormProps) {
+  const { canWrite } = useCanWrite()
   const { toast } = useToast()
   const [isValidatingVat, setIsValidatingVat] = useState(false)
   const [vatValidationResult, setVatValidationResult] = useState<{
@@ -305,12 +307,21 @@ export default function CustomerForm({
 
       {/* Submit */}
       <div className="flex justify-end gap-2">
-        <Button type="submit" disabled={isLoading}>
+        <Button
+          type="submit"
+          disabled={isLoading || !canWrite}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+        >
           {isLoading ? (
             <>
               <Loader2 className="mr-2 h-4 w-4 animate-spin" />
               Sparar...
             </>
+          ) : !canWrite ? (
+            <>
+              <Lock className="mr-2 h-4 w-4" />
+              Spara kund
+            </>
           ) : (
             'Spara kund'
           )}
diff --git a/components/dashboard/CompanySwitcher.tsx b/components/dashboard/CompanySwitcher.tsx
index e7aacfee..208ac308 100644
--- a/components/dashboard/CompanySwitcher.tsx
+++ b/components/dashboard/CompanySwitcher.tsx
@@ -1,8 +1,7 @@
 'use client'
 
-import { useState, useRef, useEffect, useTransition, useCallback } from 'react'
+import { useState, useRef, useEffect, useCallback } from 'react'
 import { createPortal } from 'react-dom'
-import { useRouter } from 'next/navigation'
 import Link from 'next/link'
 import { cn } from '@/lib/utils'
 import { useCompany } from '@/contexts/CompanyContext'
@@ -11,9 +10,8 @@ import { Check, ChevronsUpDown, Plus, Loader2 } from 'lucide-react'
 
 export default function CompanySwitcher() {
   const { company, companies } = useCompany()
-  const router = useRouter()
   const [open, setOpen] = useState(false)
-  const [isPending, startTransition] = useTransition()
+  const [isPending, setIsPending] = useState(false)
   const triggerRef = useRef<HTMLButtonElement>(null)
   const dropdownRef = useRef<HTMLDivElement>(null)
   const [dropdownPos, setDropdownPos] = useState({ top: 0, left: 0 })
@@ -73,27 +71,52 @@ export default function CompanySwitcher() {
     return () => document.removeEventListener('keydown', handleKey)
   }, [open])
 
-  const handleSwitch = (companyId: string) => {
+  const handleSwitch = async (companyId: string) => {
     if (company && companyId === company.id) {
       setOpen(false)
       return
     }
-    startTransition(async () => {
-      const result = await switchCompany(companyId)
-      if (!result.error) {
-        setOpen(false)
-        router.refresh()
+    setIsPending(true)
+    const result = await switchCompany(companyId)
+    if (result.error) {
+      setIsPending(false)
+      return
+    }
+    // Notify every other open tab of the same user so they hard-reload
+    // onto the new company. BroadcastChannel is best-effort — if the
+    // browser doesn't support it (very old) we still hard-reload
+    // ourselves, and other tabs will self-correct via the visibilitychange
+    // / pageshow listeners in CompanyTabSync on their next focus event.
+    if (typeof BroadcastChannel !== 'undefined') {
+      try {
+        const channel = new BroadcastChannel('gnubok-company-switch')
+        channel.postMessage({ companyId })
+        channel.close()
+      } catch {
+        // Ignore — hard reload still happens below
       }
-    })
+    }
+    // Hard navigation — tears down React state, router cache, in-flight
+    // fetches, blob URLs, etc. This is the whole point: nothing from the
+    // previous company can survive the switch.
+    window.location.assign('/')
   }
 
   // Always allow opening the dropdown (to show "Lägg till företag")
   const hasMultiple = companies.length > 1
-  const canOpen = companies.length > 0
 
-  // No companies yet — hide the switcher entirely
+  // No companies yet — show a direct "Lägg till företag" link instead of
+  // the switcher so the user can still create one.
   if (!company && companies.length === 0) {
-    return null
+    return (
+      <Link
+        href="/onboarding"
+        className="flex items-center gap-2 w-full text-left rounded-lg border border-dashed border-border/60 hover:border-foreground/30 hover:bg-muted/40 -mx-1 px-2 py-1.5 transition-all duration-150"
+      >
+        <Plus className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+        <span className="text-[13px] text-muted-foreground truncate">Lägg till företag</span>
+      </Link>
+    )
   }
 
   return (
diff --git a/components/dashboard/CompanyTabSync.tsx b/components/dashboard/CompanyTabSync.tsx
new file mode 100644
index 00000000..64d48b48
--- /dev/null
+++ b/components/dashboard/CompanyTabSync.tsx
@@ -0,0 +1,97 @@
+'use client'
+
+import { useEffect } from 'react'
+import { useCompany } from '@/contexts/CompanyContext'
+
+/**
+ * CompanyTabSync — cross-tab active company enforcement.
+ *
+ * Mounted once inside the dashboard layout (via CompanyProvider), this
+ * component guarantees that every open tab of the same user always shows
+ * the same active company. It has three layers:
+ *
+ *   1. BroadcastChannel('gnubok-company-switch')
+ *      When the user switches company in one tab, every other live tab
+ *      receives the message and hard-reloads if its current company differs
+ *      from the broadcasted one.
+ *
+ *   2. visibilitychange
+ *      Catches tabs that were hidden/minimized during a switch. On focus,
+ *      the tab checks /api/company/current and reloads on mismatch — before
+ *      any pixel of stale data is painted to the user.
+ *
+ *   3. pageshow with event.persisted === true
+ *      Catches tabs restored from the browser's bfcache (back/forward
+ *      navigation). bfcache literally freezes the DOM and JS state, so
+ *      neither BroadcastChannel nor visibilitychange fires. pageshow is the
+ *      only reliable signal and is guaranteed to fire on bfcache restore.
+ *
+ * All three layers converge on the same action: window.location.assign('/')
+ * — a hard navigation that wipes React state, the router cache, in-flight
+ * requests, blob URLs, and every other in-tab leak vector.
+ *
+ * No-op when the user has no active company (renders nothing, attaches no
+ * listeners).
+ */
+export default function CompanyTabSync() {
+  const { company } = useCompany()
+  const currentCompanyId = company?.id ?? null
+
+  useEffect(() => {
+    const hardReload = () => {
+      window.location.assign('/')
+    }
+
+    // Layer 1: BroadcastChannel — live cross-tab sync
+    let channel: BroadcastChannel | null = null
+    if (typeof BroadcastChannel !== 'undefined') {
+      channel = new BroadcastChannel('gnubok-company-switch')
+      channel.onmessage = (event: MessageEvent<{ companyId: string | null }>) => {
+        const incomingId = event.data?.companyId ?? null
+        if (incomingId !== currentCompanyId) {
+          hardReload()
+        }
+      }
+    }
+
+    // Layer 2: visibilitychange — on focus, verify against server
+    const checkServer = async () => {
+      try {
+        const res = await fetch('/api/company/current', {
+          cache: 'no-store',
+          credentials: 'same-origin',
+        })
+        if (!res.ok) return
+        const data = (await res.json()) as { companyId: string | null }
+        if (data.companyId !== currentCompanyId) {
+          hardReload()
+        }
+      } catch {
+        // Network error / offline — do nothing (don't accidentally reload-loop)
+      }
+    }
+
+    const handleVisibilityChange = () => {
+      if (document.visibilityState === 'visible') {
+        void checkServer()
+      }
+    }
+    document.addEventListener('visibilitychange', handleVisibilityChange)
+
+    // Layer 3: pageshow (persisted === true) — bfcache restore
+    const handlePageShow = (event: PageTransitionEvent) => {
+      if (event.persisted) {
+        void checkServer()
+      }
+    }
+    window.addEventListener('pageshow', handlePageShow)
+
+    return () => {
+      channel?.close()
+      document.removeEventListener('visibilitychange', handleVisibilityChange)
+      window.removeEventListener('pageshow', handlePageShow)
+    }
+  }, [currentCompanyId])
+
+  return null
+}
diff --git a/components/dashboard/DashboardNav.tsx b/components/dashboard/DashboardNav.tsx
index d3e0abac..6cd41520 100644
--- a/components/dashboard/DashboardNav.tsx
+++ b/components/dashboard/DashboardNav.tsx
@@ -30,6 +30,7 @@ import {
 import { resolveIcon } from '@/lib/extensions/icon-resolver'
 import { SupportLink } from '@/components/ui/support-link'
 import CompanySwitcher from '@/components/dashboard/CompanySwitcher'
+import { useCompany } from '@/contexts/CompanyContext'
 import type { EntityType } from '@/types'
 
 interface ExtensionNavItem {
@@ -87,13 +88,23 @@ const groupLabels: Record<string, string> = {
   övrigt: 'Övrigt',
 }
 
-export default function DashboardNav({ companyName, entityType, uncategorizedTransactionCount = 0, pendingOperationsCount = 0, isSandbox = false, extensionNavItems = [] }: DashboardNavProps) {
+export default function DashboardNav({ companyName: _companyName, entityType, uncategorizedTransactionCount = 0, pendingOperationsCount = 0, isSandbox = false, extensionNavItems = [] }: DashboardNavProps) {
   const pathname = usePathname()
   const router = useRouter()
   const supabase = createClient()
+  const { company } = useCompany()
   const [isMobileMenuOpen, setIsMobileMenuOpen] = useState(false)
   const [isClosing, setIsClosing] = useState(false)
   const closeTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  // When the user has no active company (e.g. just archived their last
+  // one), every company-scoped route is unreachable. We keep them visible
+  // so the sidebar doesn't collapse, but render them as disabled.
+  // Only /settings remains navigable — from there the user can either
+  // create a new company or delete their account.
+  const hasCompany = !!company
+  const ALWAYS_ENABLED = new Set(['/settings'])
+  const isItemEnabled = (href: string) => hasCompany || ALWAYS_ENABLED.has(href)
   // Auto-expand Övrigt when the user is on one of its pages, or when manually toggled
   const isOnOvrigtPage = ['/help', '/settings', '/e/'].some(p => pathname.startsWith(p))
   const [manualOvrigtExpanded, setManualOvrigtExpanded] = useState(false)
@@ -175,23 +186,40 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                   {mainItems.map((item) => {
                     const Icon = item.icon
                     const active = isActive(item.href)
-                    return (
-                      <Link
-                        key={item.href}
-                        href={item.href}
-                        className={cn(
-                          'group flex items-center px-3 py-[7px] text-[13px] transition-colors duration-150 rounded-lg',
-                          active
-                            ? 'bg-primary/12 text-foreground font-medium'
-                            : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
-                        )}
-                      >
+                    const enabled = isItemEnabled(item.href)
+                    const content = (
+                      <>
                         <Icon className={cn(
                           "mr-2.5 h-[15px] w-[15px] flex-shrink-0",
                           active ? "text-primary" : "text-muted-foreground group-hover:text-foreground"
                         )} />
                         {item.label}
+                      </>
+                    )
+                    const baseClass = cn(
+                      'group flex items-center px-3 py-[7px] text-[13px] rounded-lg',
+                      enabled
+                        ? cn(
+                            'transition-colors duration-150',
+                            active
+                              ? 'bg-primary/12 text-foreground font-medium'
+                              : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
+                          )
+                        : 'text-muted-foreground/40 cursor-not-allowed'
+                    )
+                    return enabled ? (
+                      <Link key={item.href} href={item.href} className={baseClass}>
+                        {content}
                       </Link>
+                    ) : (
+                      <div
+                        key={item.href}
+                        className={baseClass}
+                        aria-disabled="true"
+                        title="Lägg till ett företag för att aktivera"
+                      >
+                        {content}
+                      </div>
                     )
                   })}
                 </div>
@@ -207,22 +235,14 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                     {items.map((item) => {
                       const Icon = item.icon
                       const active = isActive(item.href)
+                      const enabled = isItemEnabled(item.href)
                       const badge = item.href === '/transactions' && uncategorizedTransactionCount > 0
                         ? uncategorizedTransactionCount
                         : item.href === '/pending' && pendingOperationsCount > 0
                           ? pendingOperationsCount
                           : null
-                      return (
-                        <Link
-                          key={item.href}
-                          href={item.href}
-                          className={cn(
-                            'group flex items-center px-3 py-[7px] text-[13px] transition-colors duration-150 rounded-lg',
-                            active
-                              ? 'bg-primary/12 text-foreground font-medium'
-                              : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
-                          )}
-                        >
+                      const content = (
+                        <>
                           <Icon className={cn(
                             "mr-2.5 h-[15px] w-[15px] flex-shrink-0",
                             active ? "text-primary" : "text-muted-foreground group-hover:text-foreground"
@@ -233,7 +253,32 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                               {badge > 99 ? '99+' : badge}
                             </span>
                           )}
+                        </>
+                      )
+                      const baseClass = cn(
+                        'group flex items-center px-3 py-[7px] text-[13px] rounded-lg',
+                        enabled
+                          ? cn(
+                              'transition-colors duration-150',
+                              active
+                                ? 'bg-primary/12 text-foreground font-medium'
+                                : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
+                            )
+                          : 'text-muted-foreground/40 cursor-not-allowed'
+                      )
+                      return enabled ? (
+                        <Link key={item.href} href={item.href} className={baseClass}>
+                          {content}
                         </Link>
+                      ) : (
+                        <div
+                          key={item.href}
+                          className={baseClass}
+                          aria-disabled="true"
+                          title="Lägg till ett företag för att aktivera"
+                        >
+                          {content}
+                        </div>
                       )
                     })}
                   </div>
@@ -257,45 +302,80 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                     {extensionNavItems.map((item) => {
                       const Icon = resolveIcon(item.icon)
                       const active = isActive(item.href)
-                      return (
-                        <Link
-                          key={item.href}
-                          href={item.href}
-                          className={cn(
-                            'group flex items-center px-3 py-[7px] text-[13px] transition-colors duration-150 rounded-lg',
-                            active
-                              ? 'bg-primary/12 text-foreground font-medium'
-                              : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
-                          )}
-                        >
+                      // Extension nav items are always company-scoped.
+                      const enabled = hasCompany
+                      const content = (
+                        <>
                           <Icon className={cn(
                             "mr-2.5 h-[15px] w-[15px] flex-shrink-0",
                             active ? "text-primary" : "text-muted-foreground group-hover:text-foreground"
                           )} />
                           {item.label}
+                        </>
+                      )
+                      const baseClass = cn(
+                        'group flex items-center px-3 py-[7px] text-[13px] rounded-lg',
+                        enabled
+                          ? cn(
+                              'transition-colors duration-150',
+                              active
+                                ? 'bg-primary/12 text-foreground font-medium'
+                                : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
+                            )
+                          : 'text-muted-foreground/40 cursor-not-allowed'
+                      )
+                      return enabled ? (
+                        <Link key={item.href} href={item.href} className={baseClass}>
+                          {content}
                         </Link>
+                      ) : (
+                        <div
+                          key={item.href}
+                          className={baseClass}
+                          aria-disabled="true"
+                          title="Lägg till ett företag för att aktivera"
+                        >
+                          {content}
+                        </div>
                       )
                     })}
                     {övrigtItems.map((item) => {
                       const Icon = item.icon
                       const active = isActive(item.href)
-                      return (
-                        <Link
-                          key={item.href}
-                          href={item.href}
-                          className={cn(
-                            'group flex items-center px-3 py-[7px] text-[13px] transition-colors duration-150 rounded-lg',
-                            active
-                              ? 'bg-primary/12 text-foreground font-medium'
-                              : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
-                          )}
-                        >
+                      const enabled = isItemEnabled(item.href)
+                      const content = (
+                        <>
                           <Icon className={cn(
                             "mr-2.5 h-[15px] w-[15px] flex-shrink-0",
                             active ? "text-primary" : "text-muted-foreground group-hover:text-foreground"
                           )} />
                           {item.label}
+                        </>
+                      )
+                      const baseClass = cn(
+                        'group flex items-center px-3 py-[7px] text-[13px] rounded-lg',
+                        enabled
+                          ? cn(
+                              'transition-colors duration-150',
+                              active
+                                ? 'bg-primary/12 text-foreground font-medium'
+                                : 'text-muted-foreground hover:text-foreground hover:bg-muted/40'
+                            )
+                          : 'text-muted-foreground/40 cursor-not-allowed'
+                      )
+                      return enabled ? (
+                        <Link key={item.href} href={item.href} className={baseClass}>
+                          {content}
                         </Link>
+                      ) : (
+                        <div
+                          key={item.href}
+                          className={baseClass}
+                          aria-disabled="true"
+                          title="Lägg till ett företag för att aktivera"
+                        >
+                          {content}
+                        </div>
                       )
                     })}
                   </div>
@@ -327,21 +407,13 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
           {mobileNavItems.map((item) => {
             const Icon = item.icon
             const active = isActive(item.href)
+            const enabled = isItemEnabled(item.href)
             const badge = item.href === '/transactions' && uncategorizedTransactionCount > 0
               ? uncategorizedTransactionCount
               : null
 
-            return (
-              <Link
-                key={item.href}
-                href={item.href}
-                className={cn(
-                  'relative flex flex-col items-center justify-center flex-1 h-full text-xs transition-colors duration-200',
-                  active
-                    ? 'text-primary'
-                    : 'text-muted-foreground'
-                )}
-              >
+            const content = (
+              <>
                 <div className="relative">
                   <Icon className={cn(
                     "h-5 w-5 mb-1",
@@ -357,7 +429,26 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                   "truncate",
                   active && "font-medium"
                 )}>{item.label}</span>
+              </>
+            )
+            const baseClass = cn(
+              'relative flex flex-col items-center justify-center flex-1 h-full text-xs',
+              enabled
+                ? cn(
+                    'transition-colors duration-200',
+                    active ? 'text-primary' : 'text-muted-foreground'
+                  )
+                : 'text-muted-foreground/40'
+            )
+
+            return enabled ? (
+              <Link key={item.href} href={item.href} className={baseClass}>
+                {content}
               </Link>
+            ) : (
+              <div key={item.href} className={baseClass} aria-disabled="true">
+                {content}
+              </div>
             )
           })}
           {/* Menu button */}
@@ -424,21 +515,37 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                 {mainItems.map((item) => {
                   const Icon = item.icon
                   const active = isActive(item.href)
-                  return (
+                  const enabled = isItemEnabled(item.href)
+                  const content = (
+                    <>
+                      <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
+                      <span className="text-sm">{item.label}</span>
+                    </>
+                  )
+                  const baseClass = cn(
+                    'flex items-center gap-3 px-3 min-h-[44px] rounded-lg',
+                    enabled
+                      ? cn(
+                          'transition-colors',
+                          active
+                            ? 'bg-primary/10 text-primary font-medium'
+                            : 'text-foreground active:bg-muted/60'
+                        )
+                      : 'text-muted-foreground/40'
+                  )
+                  return enabled ? (
                     <Link
                       key={item.href}
                       href={item.href}
                       onClick={closeMobileMenu}
-                      className={cn(
-                        'flex items-center gap-3 px-3 min-h-[44px] rounded-lg transition-colors',
-                        active
-                          ? 'bg-primary/10 text-primary font-medium'
-                          : 'text-foreground active:bg-muted/60'
-                      )}
+                      className={baseClass}
                     >
-                      <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
-                      <span className="text-sm">{item.label}</span>
+                      {content}
                     </Link>
+                  ) : (
+                    <div key={item.href} className={baseClass} aria-disabled="true">
+                      {content}
+                    </div>
                   )
                 })}
               </div>
@@ -454,23 +561,14 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                     {items.map((item) => {
                       const Icon = item.icon
                       const active = isActive(item.href)
+                      const enabled = isItemEnabled(item.href)
                       const badge = item.href === '/transactions' && uncategorizedTransactionCount > 0
                         ? uncategorizedTransactionCount
                         : item.href === '/pending' && pendingOperationsCount > 0
                           ? pendingOperationsCount
                           : null
-                      return (
-                        <Link
-                          key={item.href}
-                          href={item.href}
-                          onClick={closeMobileMenu}
-                          className={cn(
-                            'flex items-center gap-3 px-3 min-h-[44px] rounded-lg transition-colors',
-                            active
-                              ? 'bg-primary/10 text-primary font-medium'
-                              : 'text-foreground active:bg-muted/60'
-                          )}
-                        >
+                      const content = (
+                        <>
                           <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
                           <span className="text-sm flex-1">{item.label}</span>
                           {badge !== null && (
@@ -478,7 +576,32 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                               {badge > 99 ? '99+' : badge}
                             </span>
                           )}
+                        </>
+                      )
+                      const baseClass = cn(
+                        'flex items-center gap-3 px-3 min-h-[44px] rounded-lg',
+                        enabled
+                          ? cn(
+                              'transition-colors',
+                              active
+                                ? 'bg-primary/10 text-primary font-medium'
+                                : 'text-foreground active:bg-muted/60'
+                            )
+                          : 'text-muted-foreground/40'
+                      )
+                      return enabled ? (
+                        <Link
+                          key={item.href}
+                          href={item.href}
+                          onClick={closeMobileMenu}
+                          className={baseClass}
+                        >
+                          {content}
                         </Link>
+                      ) : (
+                        <div key={item.href} className={baseClass} aria-disabled="true">
+                          {content}
+                        </div>
                       )
                     })}
                   </div>
@@ -496,41 +619,73 @@ export default function DashboardNav({ companyName, entityType, uncategorizedTra
                 {extensionNavItems.map((item) => {
                   const Icon = resolveIcon(item.icon)
                   const active = isActive(item.href)
-                  return (
+                  const enabled = hasCompany
+                  const content = (
+                    <>
+                      <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
+                      <span className="text-sm">{item.label}</span>
+                    </>
+                  )
+                  const baseClass = cn(
+                    'flex items-center gap-3 px-3 min-h-[44px] rounded-lg',
+                    enabled
+                      ? cn(
+                          'transition-colors',
+                          active
+                            ? 'bg-primary/10 text-primary font-medium'
+                            : 'text-foreground active:bg-muted/60'
+                        )
+                      : 'text-muted-foreground/40'
+                  )
+                  return enabled ? (
                     <Link
                       key={item.href}
                       href={item.href}
                       onClick={closeMobileMenu}
-                      className={cn(
-                        'flex items-center gap-3 px-3 min-h-[44px] rounded-lg transition-colors',
-                        active
-                          ? 'bg-primary/10 text-primary font-medium'
-                          : 'text-foreground active:bg-muted/60'
-                      )}
+                      className={baseClass}
                     >
-                      <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
-                      <span className="text-sm">{item.label}</span>
+                      {content}
                     </Link>
+                  ) : (
+                    <div key={item.href} className={baseClass} aria-disabled="true">
+                      {content}
+                    </div>
                   )
                 })}
                 {övrigtItems.map((item) => {
                   const Icon = item.icon
                   const active = isActive(item.href)
-                  return (
+                  const enabled = isItemEnabled(item.href)
+                  const content = (
+                    <>
+                      <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
+                      <span className="text-sm">{item.label}</span>
+                    </>
+                  )
+                  const baseClass = cn(
+                    'flex items-center gap-3 px-3 min-h-[44px] rounded-lg',
+                    enabled
+                      ? cn(
+                          'transition-colors',
+                          active
+                            ? 'bg-primary/10 text-primary font-medium'
+                            : 'text-foreground active:bg-muted/60'
+                        )
+                      : 'text-muted-foreground/40'
+                  )
+                  return enabled ? (
                     <Link
                       key={item.href}
                       href={item.href}
                       onClick={closeMobileMenu}
-                      className={cn(
-                        'flex items-center gap-3 px-3 min-h-[44px] rounded-lg transition-colors',
-                        active
-                          ? 'bg-primary/10 text-primary font-medium'
-                          : 'text-foreground active:bg-muted/60'
-                      )}
+                      className={baseClass}
                     >
-                      <Icon className={cn("h-[18px] w-[18px] flex-shrink-0", active ? "text-primary" : "text-muted-foreground")} />
-                      <span className="text-sm">{item.label}</span>
+                      {content}
                     </Link>
+                  ) : (
+                    <div key={item.href} className={baseClass} aria-disabled="true">
+                      {content}
+                    </div>
                   )
                 })}
               </div>
diff --git a/components/deadlines/DeadlineForm.tsx b/components/deadlines/DeadlineForm.tsx
index 795e92b7..0646be12 100644
--- a/components/deadlines/DeadlineForm.tsx
+++ b/components/deadlines/DeadlineForm.tsx
@@ -21,6 +21,8 @@ import {
 } from '@/components/ui/select'
 import { Deadline, DeadlineType, DeadlinePriority } from '@/types'
 import { formatDateISO, DEADLINE_TYPE_LABELS, PRIORITY_LABELS } from '@/lib/calendar/utils'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
+import { Lock } from 'lucide-react'
 
 interface DeadlineFormProps {
   open: boolean
@@ -41,6 +43,7 @@ export function DeadlineForm({
   initialDate,
   customers,
 }: DeadlineFormProps) {
+  const { canWrite } = useCanWrite()
   const [confirmDelete, setConfirmDelete] = useState(false)
   const [isLoading, setIsLoading] = useState(false)
   const [formData, setFormData] = useState({
@@ -300,7 +303,12 @@ export function DeadlineForm({
               >
                 Avbryt
               </Button>
-              <Button type="submit" disabled={isLoading || !formData.title}>
+              <Button
+                type="submit"
+                disabled={isLoading || !formData.title || !canWrite}
+                title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+              >
+                {!canWrite && <Lock className="mr-2 h-4 w-4" />}
                 {isLoading ? 'Sparar...' : initialData?.id ? 'Spara' : 'Skapa'}
               </Button>
             </div>
diff --git a/components/deadlines/DeadlineList.tsx b/components/deadlines/DeadlineList.tsx
index d804e863..1bbfeb0c 100644
--- a/components/deadlines/DeadlineList.tsx
+++ b/components/deadlines/DeadlineList.tsx
@@ -7,7 +7,8 @@ import { DeadlineCard } from './DeadlineCard'
 import { DeadlineFilters } from './DeadlineFilters'
 import { DeadlineForm } from './DeadlineForm'
 import { isDeadlineOverdue } from '@/lib/calendar/utils'
-import { Plus } from 'lucide-react'
+import { Plus, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 
 interface DeadlineListProps {
   deadlines: Deadline[]
@@ -26,6 +27,7 @@ export function DeadlineList({
   onDeadlineEdit,
   onDeadlineDelete,
 }: DeadlineListProps) {
+  const { canWrite } = useCanWrite()
   const [statusFilter, setStatusFilter] = useState<'all' | 'pending' | 'completed'>('pending')
   const [typeFilter, setTypeFilter] = useState<DeadlineType | 'all'>('all')
   const [showForm, setShowForm] = useState(false)
@@ -105,8 +107,16 @@ export function DeadlineList({
           onTypeChange={setTypeFilter}
           onReset={handleResetFilters}
         />
-        <Button onClick={() => setShowForm(true)}>
-          <Plus className="h-4 w-4 mr-2" />
+        <Button
+          onClick={() => setShowForm(true)}
+          disabled={!canWrite}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+        >
+          {canWrite ? (
+            <Plus className="h-4 w-4 mr-2" />
+          ) : (
+            <Lock className="h-4 w-4 mr-2" />
+          )}
           Ny deadline
         </Button>
       </div>
@@ -124,8 +134,14 @@ export function DeadlineList({
             size="sm"
             className="mt-4"
             onClick={() => setShowForm(true)}
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
           >
-            <Plus className="h-3.5 w-3.5 mr-1.5" />
+            {canWrite ? (
+              <Plus className="h-3.5 w-3.5 mr-1.5" />
+            ) : (
+              <Lock className="h-3.5 w-3.5 mr-1.5" />
+            )}
             Skapa en deadline
           </Button>
         </div>
diff --git a/components/import/BankFileConfirmStep.tsx b/components/import/BankFileConfirmStep.tsx
index 22f0145e..b9bfdee3 100644
--- a/components/import/BankFileConfirmStep.tsx
+++ b/components/import/BankFileConfirmStep.tsx
@@ -10,8 +10,10 @@ import {
   FileText,
   Link2,
   Calendar,
+  Lock,
 } from 'lucide-react'
 import { formatCurrency } from '@/lib/utils'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { BankFileParseResult } from '@/lib/import/bank-file/types'
 
 interface BankFileConfirmStepProps {
@@ -27,6 +29,7 @@ export default function BankFileConfirmStep({
   onBack,
   isLoading,
 }: BankFileConfirmStepProps) {
+  const { canWrite } = useCanWrite()
   const { transactions, stats, date_from, date_to } = parseResult
   const refsCount = transactions.filter((t) => t.reference).length
 
@@ -123,13 +126,19 @@ export default function BankFileConfirmStep({
             skip_duplicates: true,
             auto_categorize: false,
           })}
-          disabled={isLoading}
+          disabled={isLoading || !canWrite}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
         >
           {isLoading ? (
             <>
               <Loader2 className="mr-2 h-4 w-4 animate-spin" />
               Importerar...
             </>
+          ) : !canWrite ? (
+            <>
+              <Lock className="mr-2 h-4 w-4" />
+              Importera {stats.parsed_rows} transaktioner
+            </>
           ) : (
             <>
               <Play className="mr-2 h-4 w-4" />
diff --git a/components/import/ImportReviewStep.tsx b/components/import/ImportReviewStep.tsx
index 24713f50..b66dd39d 100644
--- a/components/import/ImportReviewStep.tsx
+++ b/components/import/ImportReviewStep.tsx
@@ -21,8 +21,10 @@ import {
   Calendar,
   FileText,
   Database,
+  Lock,
 } from 'lucide-react'
 import { useUnsavedChanges } from '@/lib/hooks/use-unsaved-changes'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { ImportPreview, AccountMapping } from '@/lib/import/types'
 
 interface ImportReviewStepProps {
@@ -47,6 +49,7 @@ export default function ImportReviewStep({
   onBack,
   isLoading,
 }: ImportReviewStepProps) {
+  const { canWrite } = useCanWrite()
   const [options, setOptions] = useState<ImportExecuteOptions>({
     createFiscalPeriod: true,
     importOpeningBalances: true,
@@ -295,9 +298,15 @@ export default function ImportReviewStep({
         <Button variant="outline" className="min-h-11" onClick={onBack}>
           Tillbaka
         </Button>
-        <Button className="min-h-11" onClick={handleExecute}>
+        <Button
+          className="min-h-11"
+          onClick={handleExecute}
+          disabled={!canWrite || isLoading}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+        >
+          {!canWrite && <Lock className="mr-2 h-4 w-4" />}
           Starta import
-          <ArrowRight className="ml-2 h-4 w-4" />
+          {canWrite && <ArrowRight className="ml-2 h-4 w-4" />}
         </Button>
       </div>
     </div>
diff --git a/components/settings/AccountDangerZone.tsx b/components/settings/AccountDangerZone.tsx
index ae5fa0d4..cacb38f2 100644
--- a/components/settings/AccountDangerZone.tsx
+++ b/components/settings/AccountDangerZone.tsx
@@ -1,8 +1,9 @@
 'use client'
 
-import { useState } from 'react'
+import { useState, useEffect } from 'react'
 import { useRouter } from 'next/navigation'
 import Link from 'next/link'
+import { createClient } from '@/lib/supabase/client'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
@@ -14,37 +15,89 @@ import {
   DialogHeader,
   DialogTitle,
 } from '@/components/ui/dialog'
-import { AlertTriangle, ExternalLink, Loader2 } from 'lucide-react'
+import { RetentionNotice } from '@/components/ui/retention-notice'
+import { ExternalLink, Loader2 } from 'lucide-react'
 import { SupportLink } from '@/components/ui/support-link'
 
+interface Blocker {
+  id: string
+  name: string
+}
+
 export function AccountDangerZone() {
   const router = useRouter()
+  const [email, setEmail] = useState<string | null>(null)
+  const [blockers, setBlockers] = useState<Blocker[]>([])
+  const [blockersLoading, setBlockersLoading] = useState(true)
   const [showDialog, setShowDialog] = useState(false)
   const [confirmText, setConfirmText] = useState('')
   const [isDeleting, setIsDeleting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+
+    async function load() {
+      const supabase = createClient()
+      const { data: { user } } = await supabase.auth.getUser()
+      if (!cancelled) setEmail(user?.email ?? null)
+
+      try {
+        const res = await fetch('/api/company?owned=true&archived=false')
+        if (res.ok) {
+          const body = await res.json()
+          if (!cancelled) setBlockers(body.data ?? [])
+        }
+      } finally {
+        if (!cancelled) setBlockersLoading(false)
+      }
+    }
+
+    load()
+    return () => {
+      cancelled = true
+    }
+  }, [])
 
   async function handleDelete() {
-    if (confirmText !== 'RADERA') return
+    if (!email) return
+    if (confirmText.trim().toLowerCase() !== email.toLowerCase()) return
+
     setIsDeleting(true)
+    setError(null)
 
     try {
       const response = await fetch('/api/account/delete', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ confirm: 'RADERA' }),
+        body: JSON.stringify({ confirm_email: email }),
       })
 
+      if (response.status === 409) {
+        const body = await response.json()
+        // Precondition tripped mid-flow — refresh the list and show inline.
+        setBlockers(body.blockers ?? [])
+        setError(body.error || 'Du måste radera eller överlåta dina företag först.')
+        setIsDeleting(false)
+        setShowDialog(false)
+        return
+      }
+
       if (!response.ok) {
-        const result = await response.json()
-        throw new Error(result.error || 'Kunde inte radera kontot')
+        const body = await response.json().catch(() => ({}))
+        throw new Error(body.error || 'Kunde inte radera kontot')
       }
 
       router.push('/login')
-    } catch {
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Kunde inte radera kontot')
       setIsDeleting(false)
     }
   }
 
+  const hasBlockers = blockers.length > 0
+  const canDelete = !hasBlockers && !blockersLoading
+
   return (
     <>
       <section className="space-y-4 border-t border-border/8 pt-8">
@@ -52,25 +105,38 @@ export function AccountDangerZone() {
           Radera konto
         </h2>
 
-        <div className="rounded-lg border border-destructive/30 bg-destructive/5 p-4">
-          <div className="flex gap-3">
-            <AlertTriangle className="h-5 w-5 text-destructive shrink-0 mt-0.5" />
-            <div className="space-y-2 text-sm">
-              <p className="font-medium text-destructive">Denna åtgärd kan inte ångras</p>
-              <p className="text-muted-foreground">
-                All din data raderas permanent — bokföring, fakturor, verifikationer, dokument och inställningar.
-              </p>
-              <p className="text-muted-foreground">
-                Enligt bokföringslagen (BFL 7 kap. 2§) ska räkenskapsinformation bevaras i 7 år.
-                Du ansvarar själv för att exportera och arkivera din bokföringsdata.
-              </p>
-              <p className="text-muted-foreground">
-                Har du frågor?{' '}
-                <SupportLink variant="inline" subject="Fråga om kontoradering" />
-              </p>
-            </div>
+        {hasBlockers && (
+          <div className="rounded-lg border border-border/60 bg-muted/30 p-4 space-y-3">
+            <p className="text-sm font-medium">Företag du äger</p>
+            <p className="text-sm text-muted-foreground">
+              Radera eller överlåt alla företag innan du raderar kontot.
+            </p>
+            <ul className="space-y-2">
+              {blockers.map((b) => (
+                <li
+                  key={b.id}
+                  className="flex items-center justify-between rounded-md border border-border/40 bg-background px-3 py-2"
+                >
+                  <span className="text-sm font-medium">{b.name}</span>
+                  <Button variant="ghost" size="sm" asChild>
+                    <Link href="/settings/company">Hantera</Link>
+                  </Button>
+                </li>
+              ))}
+            </ul>
           </div>
-        </div>
+        )}
+
+        <RetentionNotice variant="account" />
+
+        <p className="text-sm text-muted-foreground">
+          Har du frågor?{' '}
+          <SupportLink variant="inline" subject="Fråga om kontoradering" />
+        </p>
+
+        {error && !showDialog && (
+          <p className="text-sm text-destructive">{error}</p>
+        )}
 
         <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
           <Button variant="outline" className="w-full sm:w-auto" asChild>
@@ -83,37 +149,55 @@ export function AccountDangerZone() {
             variant="destructive"
             className="w-full sm:w-auto"
             onClick={() => setShowDialog(true)}
+            disabled={!canDelete}
           >
             Radera mitt konto
           </Button>
         </div>
       </section>
 
-      <Dialog open={showDialog} onOpenChange={(open) => {
-        setShowDialog(open)
-        if (!open) setConfirmText('')
-      }}>
+      <Dialog
+        open={showDialog}
+        onOpenChange={(open) => {
+          if (isDeleting) return
+          setShowDialog(open)
+          if (!open) {
+            setConfirmText('')
+            setError(null)
+          }
+        }}
+      >
         <DialogContent>
           <DialogHeader>
             <DialogTitle>Radera konto permanent</DialogTitle>
             <DialogDescription>
-              All din data raderas permanent. Skriv <strong>RADERA</strong> nedan för att bekräfta.
+              Ditt konto avidentifieras och du loggas ut från alla enheter.
+              Du kan inte skapa ett nytt konto med samma e-postadress — kontakta support
+              om du vill återaktivera kontot i framtiden.
             </DialogDescription>
           </DialogHeader>
           <div className="space-y-2">
-            <Label htmlFor="delete-confirm">Bekräfta genom att skriva RADERA</Label>
+            <Label htmlFor="delete-confirm">
+              Skriv din e-postadress (<strong>{email}</strong>) för att bekräfta
+            </Label>
             <Input
               id="delete-confirm"
+              type="email"
               value={confirmText}
               onChange={(e) => setConfirmText(e.target.value)}
-              placeholder="RADERA"
+              placeholder={email ?? ''}
               autoComplete="off"
             />
+            {error && <p className="text-sm text-destructive">{error}</p>}
           </div>
           <DialogFooter>
             <Button
               variant="outline"
-              onClick={() => { setShowDialog(false); setConfirmText('') }}
+              onClick={() => {
+                setShowDialog(false)
+                setConfirmText('')
+                setError(null)
+              }}
               disabled={isDeleting}
             >
               Avbryt
@@ -121,7 +205,11 @@ export function AccountDangerZone() {
             <Button
               variant="destructive"
               onClick={handleDelete}
-              disabled={confirmText !== 'RADERA' || isDeleting}
+              disabled={
+                !email ||
+                confirmText.trim().toLowerCase() !== email.toLowerCase() ||
+                isDeleting
+              }
             >
               {isDeleting ? (
                 <>
@@ -129,7 +217,7 @@ export function AccountDangerZone() {
                   Raderar...
                 </>
               ) : (
-                'Radera permanent'
+                'Radera konto'
               )}
             </Button>
           </DialogFooter>
diff --git a/components/settings/CompanyDangerZone.tsx b/components/settings/CompanyDangerZone.tsx
new file mode 100644
index 00000000..64f17674
--- /dev/null
+++ b/components/settings/CompanyDangerZone.tsx
@@ -0,0 +1,162 @@
+'use client'
+
+import { useState } from 'react'
+import { useRouter } from 'next/navigation'
+import Link from 'next/link'
+import { useCompany } from '@/contexts/CompanyContext'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { RetentionNotice } from '@/components/ui/retention-notice'
+import { ExternalLink, Loader2 } from 'lucide-react'
+import { useToast } from '@/components/ui/use-toast'
+
+/**
+ * Danger zone for the currently-active company. Only visible to owners.
+ *
+ * Archive = soft delete: companies.archived_at is stamped via
+ * POST /api/company/[id]/delete. All bookkeeping data is retained per
+ * BFL 7 kap. 2§; the row just disappears from the user's UI.
+ *
+ * TODO(bankid): once users have a linked BankID identity, wrap the
+ * confirm step in a BankID signature gate. Guarded behind a
+ * capabilities.bankIdLinked boolean fetched from the user profile.
+ */
+export function CompanyDangerZone() {
+  const router = useRouter()
+  const { toast } = useToast()
+  const { company, role } = useCompany()
+
+  const [showDialog, setShowDialog] = useState(false)
+  const [confirmText, setConfirmText] = useState('')
+  const [isDeleting, setIsDeleting] = useState(false)
+
+  if (!company || role !== 'owner') return null
+
+  async function handleDelete() {
+    if (!company) return
+    if (confirmText.trim() !== company.name.trim()) return
+
+    setIsDeleting(true)
+    try {
+      const res = await fetch(`/api/company/${company.id}/delete`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ confirm_name: confirmText }),
+      })
+
+      if (!res.ok) {
+        const body = await res.json().catch(() => ({}))
+        throw new Error(body.error || 'Kunde inte radera företaget')
+      }
+
+      toast({ title: 'Företaget raderades', description: company.name })
+      // Stay inside settings. If the user had another company, the dashboard
+      // layout will resolve it and /settings/account still renders as
+      // normal. If this was their last company, the layout falls into the
+      // no-company shell rooted at /settings/account.
+      router.push('/settings/account')
+      router.refresh()
+    } catch (err) {
+      toast({
+        title: 'Kunde inte radera företaget',
+        description: err instanceof Error ? err.message : 'Försök igen.',
+        variant: 'destructive',
+      })
+      setIsDeleting(false)
+    }
+  }
+
+  return (
+    <>
+      <section className="space-y-4 border-t border-border/8 pt-8">
+        <h2 className="text-sm font-medium uppercase tracking-wider text-destructive/80">
+          Radera företag
+        </h2>
+
+        <RetentionNotice variant="company" />
+
+        <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+          <Button variant="outline" className="w-full sm:w-auto" asChild>
+            <Link href="/reports?type=full-archive">
+              <ExternalLink className="mr-2 h-4 w-4" />
+              Exportera fullständigt arkiv
+            </Link>
+          </Button>
+          <Button
+            variant="destructive"
+            className="w-full sm:w-auto"
+            onClick={() => setShowDialog(true)}
+          >
+            Radera företag
+          </Button>
+        </div>
+      </section>
+
+      <Dialog
+        open={showDialog}
+        onOpenChange={(open) => {
+          if (isDeleting) return
+          setShowDialog(open)
+          if (!open) setConfirmText('')
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Radera {company.name}</DialogTitle>
+            <DialogDescription>
+              Företaget döljs från gnubok. Bokföringen behålls säkert i 7 år enligt BFL.
+              Skriv företagets namn exakt för att bekräfta.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-2">
+            <Label htmlFor="company-delete-confirm">
+              Skriv <strong>{company.name}</strong> för att bekräfta
+            </Label>
+            <Input
+              id="company-delete-confirm"
+              value={confirmText}
+              onChange={(e) => setConfirmText(e.target.value)}
+              placeholder={company.name}
+              autoComplete="off"
+            />
+          </div>
+          <DialogFooter>
+            <Button
+              variant="outline"
+              onClick={() => {
+                setShowDialog(false)
+                setConfirmText('')
+              }}
+              disabled={isDeleting}
+            >
+              Avbryt
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={handleDelete}
+              disabled={confirmText.trim() !== company.name.trim() || isDeleting}
+            >
+              {isDeleting ? (
+                <>
+                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  Raderar...
+                </>
+              ) : (
+                'Radera företag'
+              )}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
diff --git a/components/settings/SettingsFormWrapper.tsx b/components/settings/SettingsFormWrapper.tsx
index 5aaf1781..f813e6f0 100644
--- a/components/settings/SettingsFormWrapper.tsx
+++ b/components/settings/SettingsFormWrapper.tsx
@@ -2,8 +2,9 @@
 
 import { useState, useRef, useEffect, useCallback } from 'react'
 import { Button } from '@/components/ui/button'
-import { Loader2, Check } from 'lucide-react'
+import { Loader2, Check, Lock } from 'lucide-react'
 import { useToast } from '@/components/ui/use-toast'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 
 type SaveResult =
   | Record<string, unknown>
@@ -17,6 +18,7 @@ interface SettingsFormWrapperProps {
 
 export function SettingsFormWrapper({ children, onSave, className }: SettingsFormWrapperProps) {
   const { toast } = useToast()
+  const { canWrite } = useCanWrite()
   const [isSaving, setIsSaving] = useState(false)
   const [saved, setSaved] = useState(false)
   const timerRef = useRef<ReturnType<typeof setTimeout>>(undefined)
@@ -82,12 +84,22 @@ export function SettingsFormWrapper({ children, onSave, className }: SettingsFor
             Sparat
           </span>
         )}
-        <Button type="submit" disabled={isSaving} size="sm">
+        <Button
+          type="submit"
+          disabled={isSaving || !canWrite}
+          size="sm"
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+        >
           {isSaving ? (
             <>
               <Loader2 className="mr-2 h-3.5 w-3.5 animate-spin" />
               Sparar...
             </>
+          ) : !canWrite ? (
+            <>
+              <Lock className="mr-2 h-3.5 w-3.5" />
+              Spara ändringar
+            </>
           ) : (
             'Spara ändringar'
           )}
diff --git a/components/suppliers/SupplierForm.tsx b/components/suppliers/SupplierForm.tsx
index 057ff8c7..eae1977f 100644
--- a/components/suppliers/SupplierForm.tsx
+++ b/components/suppliers/SupplierForm.tsx
@@ -8,7 +8,8 @@ import { Input } from '@/components/ui/input'
 import { Label } from '@/components/ui/label'
 import { Textarea } from '@/components/ui/textarea'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
-import { Loader2 } from 'lucide-react'
+import { Loader2, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { CreateSupplierInput, SupplierType } from '@/types'
 
 const schema = z.object({
@@ -46,6 +47,7 @@ export default function SupplierForm({
   isLoading,
   initialData,
 }: SupplierFormProps) {
+  const { canWrite } = useCanWrite()
   const {
     register,
     handleSubmit,
@@ -275,12 +277,21 @@ export default function SupplierForm({
 
       {/* Submit */}
       <div className="flex justify-end gap-2">
-        <Button type="submit" disabled={isLoading}>
+        <Button
+          type="submit"
+          disabled={isLoading || !canWrite}
+          title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+        >
           {isLoading ? (
             <>
               <Loader2 className="mr-2 h-4 w-4 animate-spin" />
               Sparar...
             </>
+          ) : !canWrite ? (
+            <>
+              <Lock className="mr-2 h-4 w-4" />
+              Spara leverantör
+            </>
           ) : (
             'Spara leverantör'
           )}
diff --git a/components/transactions/TransactionStatusBar.tsx b/components/transactions/TransactionStatusBar.tsx
index cdec5a7d..1de7d11c 100644
--- a/components/transactions/TransactionStatusBar.tsx
+++ b/components/transactions/TransactionStatusBar.tsx
@@ -3,7 +3,8 @@
 import { Button } from '@/components/ui/button'
 import { Badge } from '@/components/ui/badge'
 import Link from 'next/link'
-import { Upload, Wand, Plus, CheckSquare, FileText } from 'lucide-react'
+import { Upload, Wand, Plus, CheckSquare, FileText, Lock } from 'lucide-react'
+import { useCanWrite } from '@/lib/hooks/use-can-write'
 import type { ViewMode } from './transaction-types'
 
 interface TransactionStatusBarProps {
@@ -29,6 +30,7 @@ export default function TransactionStatusBar({
   isBatchMode,
   onToggleBatchMode,
 }: TransactionStatusBarProps) {
+  const { canWrite } = useCanWrite()
   return (
     <div className="space-y-4">
       {/* Header with title + actions */}
@@ -79,8 +81,17 @@ export default function TransactionStatusBar({
               </Button>
             </>
           )}
-          <Button size="sm" onClick={onOpenCreateDialog}>
-            <Plus className="mr-2 h-4 w-4" />
+          <Button
+            size="sm"
+            onClick={onOpenCreateDialog}
+            disabled={!canWrite}
+            title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+          >
+            {canWrite ? (
+              <Plus className="mr-2 h-4 w-4" />
+            ) : (
+              <Lock className="mr-2 h-4 w-4" />
+            )}
             Ny transaktion
           </Button>
         </div>
diff --git a/components/ui/retention-notice.tsx b/components/ui/retention-notice.tsx
new file mode 100644
index 00000000..647f38ce
--- /dev/null
+++ b/components/ui/retention-notice.tsx
@@ -0,0 +1,56 @@
+'use client'
+
+import { AlertTriangle } from 'lucide-react'
+import { cn } from '@/lib/utils'
+
+interface RetentionNoticeProps {
+  variant: 'company' | 'account'
+  className?: string
+}
+
+/**
+ * Shared BFL retention notice shown before destructive actions that
+ * affect bookkeeping data. Keeps the legal copy consistent between the
+ * account danger zone and the company danger zone.
+ *
+ * Swedish Bokföringslagen (BFL) 7 kap. 2§ requires räkenskapsinformation
+ * to be retained for 7 years. gnubok is the system of record, so deleting
+ * a company or an account does not remove the underlying data — it only
+ * hides it from the UI and anonymizes PII where applicable.
+ */
+export function RetentionNotice({ variant, className }: RetentionNoticeProps) {
+  const copy =
+    variant === 'company'
+      ? {
+          title: 'Bokföringen behålls i 7 år',
+          body:
+            'Enligt bokföringslagen (BFL 7 kap. 2§) sparas räkenskapsinformation i 7 år. ' +
+            'När du raderar företaget döljs det i gnubok, men verifikationer, dokument och ' +
+            'bokföring behålls säkert tills lagkravet löpt ut.',
+        }
+      : {
+          title: 'Kontoraderingen är permanent',
+          body:
+            'Ditt konto avidentifieras och du loggas ut från alla enheter. Räkenskaps­information ' +
+            'från företag du ägt behålls säkert i 7 år enligt BFL 7 kap. 2§. Du kan inte skapa ett ' +
+            'nytt konto med samma e-postadress — kontakta support om du vill återaktivera kontot ' +
+            'i framtiden. Ladda gärna ner ett fullständigt arkiv innan du fortsätter.',
+        }
+
+  return (
+    <div
+      className={cn(
+        'rounded-lg border border-destructive/30 bg-destructive/5 p-4',
+        className
+      )}
+    >
+      <div className="flex gap-3">
+        <AlertTriangle className="h-5 w-5 text-destructive shrink-0 mt-0.5" />
+        <div className="space-y-1 text-sm">
+          <p className="font-medium text-destructive">{copy.title}</p>
+          <p className="text-muted-foreground">{copy.body}</p>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/lib/auth/__tests__/require-write.test.ts b/lib/auth/__tests__/require-write.test.ts
new file mode 100644
index 00000000..4e1aea12
--- /dev/null
+++ b/lib/auth/__tests__/require-write.test.ts
@@ -0,0 +1,81 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createMockSupabase } from '@/tests/helpers'
+
+vi.mock('@/lib/company/context', () => ({
+  getActiveCompanyId: vi.fn(),
+}))
+
+import { requireWritePermission } from '../require-write'
+import { getActiveCompanyId } from '@/lib/company/context'
+
+describe('requireWritePermission', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns ok for owner', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'owner' } })
+
+    const result = await requireWritePermission(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+  })
+
+  it('returns ok for admin', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'admin' } })
+
+    const result = await requireWritePermission(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+  })
+
+  it('returns ok for member', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'member' } })
+
+    const result = await requireWritePermission(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+  })
+
+  it('returns 403 for viewer', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'viewer' } })
+
+    const result = await requireWritePermission(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+      const body = await result.response.json()
+      expect(body.error).toContain('läsbehörighet')
+    }
+  })
+
+  it('returns 403 when user has no membership', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: null })
+
+    const result = await requireWritePermission(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+    }
+  })
+
+  it('returns 403 when there is no active company', async () => {
+    const { supabase } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue(null)
+
+    const result = await requireWritePermission(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+      const body = await result.response.json()
+      expect(body.error).toContain('aktivt företag')
+    }
+  })
+})
diff --git a/lib/auth/require-write.ts b/lib/auth/require-write.ts
new file mode 100644
index 00000000..6d305b12
--- /dev/null
+++ b/lib/auth/require-write.ts
@@ -0,0 +1,63 @@
+import { NextResponse } from 'next/server'
+import type { SupabaseClient } from '@supabase/supabase-js'
+import { getActiveCompanyId } from '@/lib/company/context'
+
+/**
+ * Write-permission guard for API routes.
+ *
+ * Looks up the caller's role in the currently active company. Returns a
+ * 403 JSON response if the role is 'viewer' (or if the user has no role
+ * in any resolvable company). Any other role (owner / admin / member)
+ * passes.
+ *
+ * Meant to be called AFTER `requireAuth()` in every API route that
+ * mutates tenant data (POST / PATCH / PUT / DELETE). Read-only POSTs
+ * that only generate PDFs or run utility lookups (e.g. VAT validation)
+ * should skip this check.
+ *
+ * This is the application-layer half of the defense-in-depth story; the
+ * RLS helper `public.current_user_can_write()` is the database half.
+ * Having both means a viewer who bypasses the JS UI and calls the API
+ * directly still gets a clean 403, and even if someone forgets to add
+ * this guard to a new route, the RLS policy blocks the write at the
+ * database layer.
+ */
+type WritePermissionResult =
+  | { ok: true }
+  | { ok: false; response: NextResponse }
+
+export async function requireWritePermission(
+  supabase: SupabaseClient,
+  userId: string,
+): Promise<WritePermissionResult> {
+  const companyId = await getActiveCompanyId(supabase, userId)
+
+  if (!companyId) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: 'Inget aktivt företag.' },
+        { status: 403 },
+      ),
+    }
+  }
+
+  const { data: membership } = await supabase
+    .from('company_members')
+    .select('role')
+    .eq('company_id', companyId)
+    .eq('user_id', userId)
+    .maybeSingle()
+
+  if (!membership || membership.role === 'viewer') {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: 'Du har endast läsbehörighet i detta företag.' },
+        { status: 403 },
+      ),
+    }
+  }
+
+  return { ok: true }
+}
diff --git a/lib/company/actions.ts b/lib/company/actions.ts
index 5685a2b7..2e961ae4 100644
--- a/lib/company/actions.ts
+++ b/lib/company/actions.ts
@@ -14,7 +14,10 @@ export async function switchCompany(companyId: string): Promise<{ error?: string
 
   try {
     await setActiveCompany(supabase, user.id, companyId)
-    revalidatePath('/')
+    // No revalidatePath — the client performs a hard navigation
+    // (window.location.assign) after this action returns, which wipes
+    // every React/router/fetch cache wholesale. revalidatePath would be a
+    // no-op and would just race with the hard reload.
     return {}
   } catch {
     return { error: 'Du har inte tillgång till detta företag.' }
diff --git a/lib/company/context.ts b/lib/company/context.ts
index 1a96972a..0f1aa13d 100644
--- a/lib/company/context.ts
+++ b/lib/company/context.ts
@@ -5,56 +5,52 @@ const COMPANY_COOKIE = 'gnubok-company-id'
 
 /**
  * Get the active company ID for the authenticated user.
- * Resolution order: cookie → user_preferences → first owned company.
- * Returns null if user has no companies.
+ *
+ * Resolution order: user_preferences → first non-archived membership.
+ *
+ * `user_preferences.active_company_id` is the authoritative source. The
+ * cookie `gnubok-company-id` is written as a hint for backwards-compat but
+ * is no longer READ as a source of truth, because Postgres RLS (via
+ * `current_active_company_id()`) can only read the database, not cookies.
+ * Having Next.js and RLS both read from `user_preferences` keeps them
+ * perfectly in sync.
+ *
+ * Returns null if the user has no non-archived companies.
  */
 export async function getActiveCompanyId(
   supabase: SupabaseClient,
   userId: string
 ): Promise<string | null> {
-  // 1. Try cookie
-  const cookieStore = await cookies()
-  const cookieValue = cookieStore.get(COMPANY_COOKIE)?.value
-
-  if (cookieValue) {
-    // Validate the user is a member of this company
-    const { data: membership } = await supabase
-      .from('company_members')
-      .select('company_id')
-      .eq('company_id', cookieValue)
-      .eq('user_id', userId)
-      .single()
-
-    if (membership) return membership.company_id
-  }
-
-  // 2. Try user_preferences
+  // 1. user_preferences — authoritative
   const { data: prefs } = await supabase
     .from('user_preferences')
     .select('active_company_id')
     .eq('user_id', userId)
-    .single()
+    .maybeSingle()
 
   if (prefs?.active_company_id) {
-    // Validate membership
+    // Validate the preference still points to a non-archived company the
+    // user is a member of.
     const { data: membership } = await supabase
       .from('company_members')
-      .select('company_id')
+      .select('company_id, companies!inner(archived_at)')
       .eq('company_id', prefs.active_company_id)
       .eq('user_id', userId)
-      .single()
+      .is('companies.archived_at', null)
+      .maybeSingle()
 
     if (membership) return membership.company_id
   }
 
-  // 3. Fallback: first company where user is owner (or any member)
+  // 2. Fallback: first non-archived membership by created_at
   const { data: firstCompany } = await supabase
     .from('company_members')
-    .select('company_id')
+    .select('company_id, companies!inner(archived_at)')
     .eq('user_id', userId)
+    .is('companies.archived_at', null)
     .order('created_at', { ascending: true })
     .limit(1)
-    .single()
+    .maybeSingle()
 
   return firstCompany?.company_id ?? null
 }
@@ -89,7 +85,11 @@ export async function getUserCompanies(
 }
 
 /**
- * Set the active company for the user (updates cookie + user_preferences).
+ * Set the active company for the user.
+ *
+ * Writes to `user_preferences` (authoritative, consulted by RLS via
+ * `current_active_company_id()`) and refreshes the `gnubok-company-id`
+ * cookie for backwards-compat with any code still reading it.
  */
 export async function setActiveCompany(
   supabase: SupabaseClient,
@@ -108,7 +108,7 @@ export async function setActiveCompany(
     throw new Error('User is not a member of this company')
   }
 
-  // Update user_preferences
+  // Update user_preferences — this is the authoritative value RLS reads
   await supabase
     .from('user_preferences')
     .upsert(
@@ -116,7 +116,7 @@ export async function setActiveCompany(
       { onConflict: 'user_id' }
     )
 
-  // Set cookie
+  // Refresh the cookie as a compat hint
   const cookieStore = await cookies()
   cookieStore.set(COMPANY_COOKIE, companyId, {
     path: '/',
diff --git a/lib/events/types.ts b/lib/events/types.ts
index 4bbbb6f1..4dd80135 100644
--- a/lib/events/types.ts
+++ b/lib/events/types.ts
@@ -72,6 +72,9 @@ export type CoreEvent =
   | { type: 'supplier_invoice.received'; payload: { inboxItem: InvoiceInboxItem; userId: string; companyId: string } }
   | { type: 'supplier_invoice.extracted'; payload: { inboxItem: InvoiceInboxItem; confidence: number; userId: string; companyId: string } }
   | { type: 'supplier_invoice.confirmed'; payload: { inboxItem: InvoiceInboxItem; supplierInvoice: SupplierInvoice; userId: string; companyId: string } }
+  // Company & account lifecycle
+  | { type: 'company.deleted'; payload: { companyId: string; userId: string; archivedAt: string } }
+  | { type: 'account.deleted'; payload: { userId: string; deletedAt: string } }
 
 // ============================================================
 // Helper Types
diff --git a/lib/hooks/use-can-write.ts b/lib/hooks/use-can-write.ts
new file mode 100644
index 00000000..98fd6666
--- /dev/null
+++ b/lib/hooks/use-can-write.ts
@@ -0,0 +1,23 @@
+'use client'
+
+import { useCompany } from '@/contexts/CompanyContext'
+
+/**
+ * Returns whether the current user can perform write actions in the
+ * active company. Viewers (role === 'viewer') get `canWrite = false`;
+ * owner / admin / member all get `canWrite = true`. Users with no active
+ * company (null role) also get `canWrite = false`.
+ *
+ * Used by every write-action button (create / edit / delete / send /
+ * approve / etc.) across the dashboard to render the button in a
+ * disabled state with a lock icon and tooltip.
+ *
+ * This is the UI layer of the viewer role enforcement. The API layer
+ * (`requireWritePermission()`) and RLS layer (`current_user_can_write()`)
+ * remain the security-critical backstops — this hook only controls what
+ * the user sees and can click.
+ */
+export function useCanWrite(): { canWrite: boolean } {
+  const { role } = useCompany()
+  return { canWrite: role !== null && role !== 'viewer' }
+}
diff --git a/lib/supabase/middleware.ts b/lib/supabase/middleware.ts
index fdb7a361..560b237a 100644
--- a/lib/supabase/middleware.ts
+++ b/lib/supabase/middleware.ts
@@ -49,14 +49,22 @@ export async function updateSession(request: NextRequest) {
     await supabase.auth.signOut()
   }
 
+  // Invite pages — accessible to everyone, signed in or not. A user who
+  // already has an account and is signed in should still be able to land on
+  // /invite/[token] to accept the invite with one click (see
+  // app/invite/[token]/page.tsx). If we bounce them to '/', they never see
+  // the invite at all.
+  if (pathname.startsWith('/invite')) {
+    return supabaseResponse
+  }
+
   // Public auth routes — allow access
   if (
     pathname.startsWith('/login') ||
     pathname.startsWith('/register') ||
     pathname.startsWith('/auth') ||
     pathname.startsWith('/reset-password') ||
-    pathname.startsWith('/sandbox') ||
-    pathname.startsWith('/invite')
+    pathname.startsWith('/sandbox')
   ) {
     // If user is logged in and trying to access auth pages, redirect to dashboard
     if (user) {
@@ -99,12 +107,32 @@ export async function updateSession(request: NextRequest) {
     }
   }
 
+  // Forward the pathname so server layouts can branch on it (e.g. render a
+  // no-company shell for /settings/account).
+  supabaseResponse.headers.set('x-pathname', pathname)
+
   // Company context resolution
+  const cookieCompanyId = request.cookies.get('gnubok-company-id')?.value
   const companyId = await resolveCompanyForMiddleware(supabase, user.id, request)
 
-  // No companies — only allow /onboarding, redirect everything else there
+  // If the cookie pointed at a company we can no longer resolve (e.g.
+  // archived), clear it so the browser stops sending it.
+  if (cookieCompanyId && cookieCompanyId !== companyId) {
+    supabaseResponse.cookies.set('gnubok-company-id', '', { path: '/', maxAge: 0 })
+  }
+
+  // Routes that stay accessible when the user has no active company.
+  // Needed so a user who archived their last company can still delete
+  // their account without being trapped on /onboarding forever.
+  const isNoCompanyAllowed =
+    pathname.startsWith('/onboarding') ||
+    pathname.startsWith('/settings/account') ||
+    pathname.startsWith('/api/account/') ||
+    pathname.startsWith('/api/company')
+
+  // No companies — redirect to onboarding, but allow the escape-hatch routes
   if (!companyId) {
-    if (pathname.startsWith('/onboarding')) {
+    if (isNoCompanyAllowed) {
       return supabaseResponse
     }
     return NextResponse.redirect(new URL('/onboarding', request.url))
@@ -129,53 +157,67 @@ export async function updateSession(request: NextRequest) {
 
 /**
  * Resolve the active company for the authenticated user.
- * Uses cookie → user_preferences → first membership as fallback.
+ *
+ * Resolution: user_preferences → first non-archived membership.
+ *
+ * `user_preferences.active_company_id` is the authoritative source for
+ * the active company on both the Next.js and Postgres RLS side. The
+ * `gnubok-company-id` cookie is still refreshed for legacy read paths
+ * but it is no longer READ here, because RLS (via
+ * `current_active_company_id()`) cannot see cookies — so letting the
+ * cookie override the database would re-introduce the divergence this
+ * entire migration exists to fix.
+ *
+ * When we fall back to "first membership" (no user_preferences row yet),
+ * we also upsert user_preferences so subsequent RLS lookups agree with
+ * us without needing the fallback scan.
+ *
  * Cannot use lib/company/context.ts because middleware runs on Edge.
  */
 async function resolveCompanyForMiddleware(
   supabase: ReturnType<typeof createServerClient>,
   userId: string,
-  request: NextRequest
+  _request: NextRequest
 ): Promise<string | null> {
-  // 1. Try cookie
-  const cookieCompanyId = request.cookies.get('gnubok-company-id')?.value
-  if (cookieCompanyId) {
-    const { data: membership } = await supabase
-      .from('company_members')
-      .select('company_id')
-      .eq('company_id', cookieCompanyId)
-      .eq('user_id', userId)
-      .single()
-
-    if (membership) return membership.company_id
-  }
-
-  // 2. Try user_preferences
+  // 1. user_preferences (authoritative)
   const { data: prefs } = await supabase
     .from('user_preferences')
     .select('active_company_id')
     .eq('user_id', userId)
-    .single()
+    .maybeSingle()
 
   if (prefs?.active_company_id) {
     const { data: membership } = await supabase
       .from('company_members')
-      .select('company_id')
+      .select('company_id, companies!inner(archived_at)')
       .eq('company_id', prefs.active_company_id)
       .eq('user_id', userId)
-      .single()
+      .is('companies.archived_at', null)
+      .maybeSingle()
 
     if (membership) return membership.company_id
   }
 
-  // 3. Fallback: first company membership
+  // 2. Fallback: first non-archived membership by created_at
   const { data: firstCompany } = await supabase
     .from('company_members')
-    .select('company_id')
+    .select('company_id, companies!inner(archived_at)')
     .eq('user_id', userId)
+    .is('companies.archived_at', null)
     .order('created_at', { ascending: true })
     .limit(1)
-    .single()
+    .maybeSingle()
 
-  return firstCompany?.company_id ?? null
+  if (!firstCompany) return null
+
+  // Write the fallback back to user_preferences so future RLS lookups
+  // see the same active company without needing this fallback scan.
+  await supabase
+    .from('user_preferences')
+    .upsert(
+      { user_id: userId, active_company_id: firstCompany.company_id },
+      { onConflict: 'user_id' }
+    )
+
+  return firstCompany.company_id
 }
diff --git a/supabase/migrations/20260411000001_user_company_ids_filter_archived.sql b/supabase/migrations/20260411000001_user_company_ids_filter_archived.sql
new file mode 100644
index 00000000..c0fdd77b
--- /dev/null
+++ b/supabase/migrations/20260411000001_user_company_ids_filter_archived.sql
@@ -0,0 +1,36 @@
+-- Filter archived companies out of user_company_ids() helper.
+--
+-- Soft-deleted (archived) companies must disappear from the user's UI while
+-- the underlying bookkeeping data stays intact for BFL 7 kap. 2§ 7-year
+-- retention. Routing this filter through user_company_ids() makes every
+-- company-scoped RLS policy honor it automatically.
+--
+-- Also adds companies.archived_by (who archived it) and an index on
+-- archived_at IS NULL to speed up the common "list my active companies"
+-- picker query.
+
+CREATE OR REPLACE FUNCTION public.user_company_ids()
+RETURNS SETOF uuid
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT cm.company_id
+  FROM public.company_members cm
+  JOIN public.companies c ON c.id = cm.company_id
+  WHERE cm.user_id = auth.uid()
+    AND c.archived_at IS NULL;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.user_company_ids() TO authenticated;
+
+-- Track who archived a company. ON DELETE SET NULL so a future hard-purge
+-- (7 years out) of the archiving user doesn't break the tombstone row.
+ALTER TABLE public.companies
+  ADD COLUMN archived_by uuid REFERENCES auth.users(id) ON DELETE SET NULL;
+
+-- Partial index: picker queries almost always filter to active companies.
+CREATE INDEX companies_active_idx
+  ON public.companies (id)
+  WHERE archived_at IS NULL;
diff --git a/supabase/migrations/20260411000002_profiles_anonymization.sql b/supabase/migrations/20260411000002_profiles_anonymization.sql
new file mode 100644
index 00000000..7bf3bc39
--- /dev/null
+++ b/supabase/migrations/20260411000002_profiles_anonymization.sql
@@ -0,0 +1,13 @@
+-- Add tombstone columns to profiles for account anonymization.
+--
+-- When a user deletes their account we must keep the auth.users row alive
+-- (otherwise ON DELETE CASCADE from companies.created_by would destroy
+-- retained bookkeeping data). Instead we anonymize the profile row: strip
+-- PII, stamp deleted_at + anonymized_at, and the UI falls back to
+-- "Borttagen användare" wherever the profile is displayed.
+--
+-- email and full_name are already nullable per migration 20240101000001.
+
+ALTER TABLE public.profiles
+  ADD COLUMN deleted_at    timestamptz,
+  ADD COLUMN anonymized_at timestamptz;
diff --git a/supabase/migrations/20260411000003_anonymize_user_account_rpc.sql b/supabase/migrations/20260411000003_anonymize_user_account_rpc.sql
new file mode 100644
index 00000000..086e9709
--- /dev/null
+++ b/supabase/migrations/20260411000003_anonymize_user_account_rpc.sql
@@ -0,0 +1,68 @@
+-- Replace hard-delete with anonymization: retain auth.users as a tombstone.
+--
+-- Why: BFL 7 kap. 2§ requires räkenskapsinformation to be preserved for 7
+-- years. companies.created_by references auth.users ON DELETE CASCADE, so
+-- hard-deleting the user would wipe retained verifikationer. Instead we:
+--   1) verify zero owned, non-archived companies
+--   2) remove the user from all company/team memberships
+--   3) delete per-user operational state (prefs, api keys)
+--   4) anonymize the profile
+-- The API route caller is responsible for banning the auth.users row via
+-- the admin API afterwards (SQL can't reach supabase.auth.admin).
+
+CREATE OR REPLACE FUNCTION public.anonymize_user_account(target_user_id uuid)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  blocker_count int;
+BEGIN
+  IF auth.uid() IS DISTINCT FROM target_user_id THEN
+    RAISE EXCEPTION 'Can only delete your own account';
+  END IF;
+
+  -- Precondition: zero owned, non-archived companies
+  SELECT count(*) INTO blocker_count
+  FROM public.company_members cm
+  JOIN public.companies c ON c.id = cm.company_id
+  WHERE cm.user_id = target_user_id
+    AND cm.role = 'owner'
+    AND c.archived_at IS NULL;
+
+  IF blocker_count > 0 THEN
+    RAISE EXCEPTION 'Cannot delete account: user still owns % active compan(y/ies)', blocker_count
+      USING ERRCODE = 'P0001';
+  END IF;
+
+  -- Remove memberships
+  DELETE FROM public.company_members WHERE user_id = target_user_id;
+  DELETE FROM public.team_members   WHERE user_id = target_user_id;
+
+  -- Remove per-user operational state
+  DELETE FROM public.user_preferences WHERE user_id = target_user_id;
+  DELETE FROM public.api_keys         WHERE user_id = target_user_id;
+
+  -- Anonymize profile tombstone
+  UPDATE public.profiles
+     SET email         = NULL,
+         full_name     = NULL,
+         avatar_url    = NULL,
+         deleted_at    = now(),
+         anonymized_at = now(),
+         updated_at    = now()
+   WHERE id = target_user_id;
+
+  -- NOTE: auth.users row, companies.created_by FK, and audit_log.user_id
+  -- are intentionally left intact. They now reference a banned, anonymized
+  -- tombstone row that exists solely to keep BFL-retained data valid.
+END;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.anonymize_user_account(uuid) TO authenticated;
+
+-- The old delete_user_account RPC hard-deleted auth.users, which cascaded
+-- away retained verifikationer via companies.created_by. It is incompatible
+-- with the retention model and must be removed.
+DROP FUNCTION IF EXISTS public.delete_user_account(uuid);
diff --git a/supabase/migrations/20260411120000_active_company_rls_isolation.sql b/supabase/migrations/20260411120000_active_company_rls_isolation.sql
new file mode 100644
index 00000000..f6b31a29
--- /dev/null
+++ b/supabase/migrations/20260411120000_active_company_rls_isolation.sql
@@ -0,0 +1,664 @@
+-- =============================================================================
+-- Active-company tenant isolation in RLS
+-- =============================================================================
+--
+-- Before this migration, company-scoped RLS policies allowed access to any
+-- company the user was a MEMBER of. This meant that a user with multiple
+-- memberships could see cross-company data leak into dropdowns and lists
+-- via direct browser-client queries (e.g. /invoices/new customer dropdown),
+-- because RLS only checked membership, not which company was active.
+--
+-- This migration replaces `company_id IN (SELECT user_company_ids())` with
+-- `company_id = current_active_company_id()` on every company-scoped policy.
+-- The helper function reads `user_preferences.active_company_id` with a
+-- fallback to the user's first non-archived membership. It is STABLE +
+-- SECURITY DEFINER so the result is cached per query plan and it bypasses
+-- RLS on the user_preferences + company_members tables it reads from.
+--
+-- Tables NOT updated (they stay on user_company_ids() because they must be
+-- visible across all companies the user is a member of, or use a different
+-- auth model entirely):
+--   companies, company_members, user_preferences, profiles
+--   teams, team_members, team_invitations, company_invitations
+--   provider_consent_tokens, provider_otc (consent-id scoped via team_members)
+--   bankid_identities (user-scoped, not company-scoped)
+--   storage.objects/sie-files bucket policies (different auth surface)
+--
+-- =============================================================================
+
+-- =============================================================================
+-- 1. current_active_company_id() helper
+-- =============================================================================
+CREATE OR REPLACE FUNCTION public.current_active_company_id()
+RETURNS uuid
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT COALESCE(
+    -- Active preference, validated against non-archived membership
+    (
+      SELECT up.active_company_id
+      FROM public.user_preferences up
+      JOIN public.company_members cm
+        ON cm.user_id = up.user_id AND cm.company_id = up.active_company_id
+      JOIN public.companies c
+        ON c.id = cm.company_id AND c.archived_at IS NULL
+      WHERE up.user_id = auth.uid()
+    ),
+    -- Fallback: first non-archived membership by created_at
+    (
+      SELECT cm.company_id
+      FROM public.company_members cm
+      JOIN public.companies c
+        ON c.id = cm.company_id AND c.archived_at IS NULL
+      WHERE cm.user_id = auth.uid()
+      ORDER BY cm.created_at ASC
+      LIMIT 1
+    )
+  );
+$$;
+
+GRANT EXECUTE ON FUNCTION public.current_active_company_id() TO authenticated;
+
+COMMENT ON FUNCTION public.current_active_company_id() IS
+  'Returns the active company id for auth.uid(), reading user_preferences.active_company_id '
+  'with validation against non-archived company_members, and falling back to the user''s '
+  'first non-archived membership. Used by RLS policies to enforce single-active-company '
+  'tenant isolation. STABLE so the result is cached per query plan.';
+
+-- =============================================================================
+-- 2. Drop old policies on company-scoped data tables
+-- =============================================================================
+-- We enumerate every company-scoped data table that currently uses
+-- user_company_ids() and drop all of its policies so we can recreate them
+-- below with current_active_company_id().
+
+DO $$
+DECLARE
+  pol RECORD;
+  affected_tables TEXT[] := ARRAY[
+    'company_settings', 'chart_of_accounts', 'fiscal_periods',
+    'journal_entries', 'journal_entry_lines',
+    'account_balances', 'voucher_sequences',
+    'transactions', 'bank_connections', 'bank_file_imports',
+    'customers', 'invoices', 'invoice_items',
+    'invoice_reminders', 'invoice_payments',
+    'suppliers', 'supplier_invoices', 'supplier_invoice_items',
+    'supplier_invoice_payments',
+    'receipts', 'receipt_line_items',
+    'document_attachments', 'invoice_inbox_items',
+    'mapping_rules', 'categorization_templates',
+    'deadlines', 'cost_centers', 'projects',
+    'salary_payments', 'mileage_entries',
+    'sie_imports', 'sie_account_mappings',
+    'calendar_feeds', 'chat_sessions', 'chat_messages',
+    'ai_usage_tracking', 'extension_data', 'api_keys',
+    'skatteverket_tokens', 'pending_operations', 'payment_match_log',
+    'event_log', 'notification_log', 'audit_log',
+    'provider_consents', 'voucher_gap_explanations',
+    'automation_webhooks', 'email_connections'
+  ];
+  tbl TEXT;
+BEGIN
+  FOREACH tbl IN ARRAY affected_tables
+  LOOP
+    IF EXISTS (
+      SELECT 1 FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_name = tbl
+    ) THEN
+      FOR pol IN
+        SELECT policyname FROM pg_policies
+        WHERE schemaname = 'public' AND tablename = tbl
+      LOOP
+        EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', pol.policyname, tbl);
+      END LOOP;
+    END IF;
+  END LOOP;
+END $$;
+
+-- =============================================================================
+-- 3. Recreate policies using current_active_company_id()
+-- =============================================================================
+-- Same shape as the previous user_company_ids()-based policies, just
+-- swapping the membership IN clause for an equality check against the
+-- single active company.
+
+-- company_settings
+CREATE POLICY "company_settings_select" ON public.company_settings
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "company_settings_insert" ON public.company_settings
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "company_settings_update" ON public.company_settings
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "company_settings_delete" ON public.company_settings
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- chart_of_accounts
+CREATE POLICY "chart_of_accounts_select" ON public.chart_of_accounts
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "chart_of_accounts_insert" ON public.chart_of_accounts
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "chart_of_accounts_update" ON public.chart_of_accounts
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "chart_of_accounts_delete" ON public.chart_of_accounts
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- fiscal_periods
+CREATE POLICY "fiscal_periods_select" ON public.fiscal_periods
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "fiscal_periods_insert" ON public.fiscal_periods
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "fiscal_periods_update" ON public.fiscal_periods
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "fiscal_periods_delete" ON public.fiscal_periods
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- journal_entries
+CREATE POLICY "journal_entries_select" ON public.journal_entries
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "journal_entries_insert" ON public.journal_entries
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "journal_entries_update" ON public.journal_entries
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "journal_entries_delete" ON public.journal_entries
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- journal_entry_lines (child: join to parent journal_entries)
+CREATE POLICY "journal_entry_lines_select" ON public.journal_entry_lines
+  FOR SELECT USING (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "journal_entry_lines_insert" ON public.journal_entry_lines
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "journal_entry_lines_update" ON public.journal_entry_lines
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "journal_entry_lines_delete" ON public.journal_entry_lines
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+  );
+
+-- account_balances (may not exist on fresh DBs)
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.tables
+    WHERE table_schema = 'public' AND table_name = 'account_balances'
+  ) THEN
+    EXECUTE 'CREATE POLICY "account_balances_select" ON public.account_balances FOR SELECT USING (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "account_balances_insert" ON public.account_balances FOR INSERT WITH CHECK (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "account_balances_update" ON public.account_balances FOR UPDATE USING (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "account_balances_delete" ON public.account_balances FOR DELETE USING (company_id = public.current_active_company_id())';
+  END IF;
+END $$;
+
+-- voucher_sequences
+CREATE POLICY "voucher_sequences_select" ON public.voucher_sequences
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "voucher_sequences_insert" ON public.voucher_sequences
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "voucher_sequences_update" ON public.voucher_sequences
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+
+-- transactions
+CREATE POLICY "transactions_select" ON public.transactions
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "transactions_insert" ON public.transactions
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "transactions_update" ON public.transactions
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "transactions_delete" ON public.transactions
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- bank_connections
+CREATE POLICY "bank_connections_select" ON public.bank_connections
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "bank_connections_insert" ON public.bank_connections
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "bank_connections_update" ON public.bank_connections
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "bank_connections_delete" ON public.bank_connections
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- bank_file_imports
+CREATE POLICY "bank_file_imports_select" ON public.bank_file_imports
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "bank_file_imports_insert" ON public.bank_file_imports
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "bank_file_imports_update" ON public.bank_file_imports
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "bank_file_imports_delete" ON public.bank_file_imports
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- customers
+CREATE POLICY "customers_select" ON public.customers
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "customers_insert" ON public.customers
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "customers_update" ON public.customers
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "customers_delete" ON public.customers
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- invoices
+CREATE POLICY "invoices_select" ON public.invoices
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoices_insert" ON public.invoices
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "invoices_update" ON public.invoices
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoices_delete" ON public.invoices
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- invoice_items (child: join to parent invoices)
+CREATE POLICY "invoice_items_select" ON public.invoice_items
+  FOR SELECT USING (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "invoice_items_insert" ON public.invoice_items
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "invoice_items_update" ON public.invoice_items
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "invoice_items_delete" ON public.invoice_items
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+  );
+
+-- invoice_reminders
+CREATE POLICY "invoice_reminders_select" ON public.invoice_reminders
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_reminders_insert" ON public.invoice_reminders
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_reminders_update" ON public.invoice_reminders
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_reminders_delete" ON public.invoice_reminders
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- invoice_payments
+CREATE POLICY "invoice_payments_select" ON public.invoice_payments
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_payments_insert" ON public.invoice_payments
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_payments_update" ON public.invoice_payments
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_payments_delete" ON public.invoice_payments
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- suppliers
+CREATE POLICY "suppliers_select" ON public.suppliers
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "suppliers_insert" ON public.suppliers
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "suppliers_update" ON public.suppliers
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "suppliers_delete" ON public.suppliers
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- supplier_invoices
+CREATE POLICY "supplier_invoices_select" ON public.supplier_invoices
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "supplier_invoices_insert" ON public.supplier_invoices
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "supplier_invoices_update" ON public.supplier_invoices
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "supplier_invoices_delete" ON public.supplier_invoices
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- supplier_invoice_items (child: join to parent supplier_invoices)
+CREATE POLICY "supplier_invoice_items_select" ON public.supplier_invoice_items
+  FOR SELECT USING (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "supplier_invoice_items_insert" ON public.supplier_invoice_items
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "supplier_invoice_items_update" ON public.supplier_invoice_items
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "supplier_invoice_items_delete" ON public.supplier_invoice_items
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+  );
+
+-- supplier_invoice_payments
+CREATE POLICY "supplier_invoice_payments_select" ON public.supplier_invoice_payments
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "supplier_invoice_payments_insert" ON public.supplier_invoice_payments
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "supplier_invoice_payments_update" ON public.supplier_invoice_payments
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "supplier_invoice_payments_delete" ON public.supplier_invoice_payments
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- receipts
+CREATE POLICY "receipts_select" ON public.receipts
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "receipts_insert" ON public.receipts
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "receipts_update" ON public.receipts
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "receipts_delete" ON public.receipts
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- receipt_line_items (child: join to parent receipts)
+CREATE POLICY "receipt_line_items_select" ON public.receipt_line_items
+  FOR SELECT USING (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "receipt_line_items_insert" ON public.receipt_line_items
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "receipt_line_items_update" ON public.receipt_line_items
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+  );
+CREATE POLICY "receipt_line_items_delete" ON public.receipt_line_items
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+  );
+
+-- document_attachments (DELETE is blocked by block_document_deletion trigger
+-- but we still add a policy for completeness — the trigger runs after RLS)
+CREATE POLICY "document_attachments_select" ON public.document_attachments
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "document_attachments_insert" ON public.document_attachments
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "document_attachments_update" ON public.document_attachments
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "document_attachments_delete" ON public.document_attachments
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- invoice_inbox_items
+CREATE POLICY "invoice_inbox_items_select" ON public.invoice_inbox_items
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_inbox_items_insert" ON public.invoice_inbox_items
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_inbox_items_update" ON public.invoice_inbox_items
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "invoice_inbox_items_delete" ON public.invoice_inbox_items
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- mapping_rules (system rules have company_id IS NULL)
+CREATE POLICY "mapping_rules_select" ON public.mapping_rules
+  FOR SELECT USING (company_id = public.current_active_company_id() OR company_id IS NULL);
+CREATE POLICY "mapping_rules_insert" ON public.mapping_rules
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "mapping_rules_update" ON public.mapping_rules
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "mapping_rules_delete" ON public.mapping_rules
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- categorization_templates
+CREATE POLICY "categorization_templates_select" ON public.categorization_templates
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "categorization_templates_insert" ON public.categorization_templates
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "categorization_templates_update" ON public.categorization_templates
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "categorization_templates_delete" ON public.categorization_templates
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- deadlines
+CREATE POLICY "deadlines_select" ON public.deadlines
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "deadlines_insert" ON public.deadlines
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "deadlines_update" ON public.deadlines
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "deadlines_delete" ON public.deadlines
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- cost_centers
+CREATE POLICY "cost_centers_select" ON public.cost_centers
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "cost_centers_insert" ON public.cost_centers
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "cost_centers_update" ON public.cost_centers
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "cost_centers_delete" ON public.cost_centers
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- projects
+CREATE POLICY "projects_select" ON public.projects
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "projects_insert" ON public.projects
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "projects_update" ON public.projects
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "projects_delete" ON public.projects
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- salary_payments (may not exist on fresh DBs)
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.tables
+    WHERE table_schema = 'public' AND table_name = 'salary_payments'
+  ) THEN
+    EXECUTE 'CREATE POLICY "salary_payments_select" ON public.salary_payments FOR SELECT USING (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "salary_payments_insert" ON public.salary_payments FOR INSERT WITH CHECK (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "salary_payments_update" ON public.salary_payments FOR UPDATE USING (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "salary_payments_delete" ON public.salary_payments FOR DELETE USING (company_id = public.current_active_company_id())';
+  END IF;
+END $$;
+
+-- mileage_entries (may not exist on fresh DBs)
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.tables
+    WHERE table_schema = 'public' AND table_name = 'mileage_entries'
+  ) THEN
+    EXECUTE 'CREATE POLICY "mileage_entries_select" ON public.mileage_entries FOR SELECT USING (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "mileage_entries_insert" ON public.mileage_entries FOR INSERT WITH CHECK (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "mileage_entries_update" ON public.mileage_entries FOR UPDATE USING (company_id = public.current_active_company_id())';
+    EXECUTE 'CREATE POLICY "mileage_entries_delete" ON public.mileage_entries FOR DELETE USING (company_id = public.current_active_company_id())';
+  END IF;
+END $$;
+
+-- sie_imports
+CREATE POLICY "sie_imports_select" ON public.sie_imports
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "sie_imports_insert" ON public.sie_imports
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "sie_imports_update" ON public.sie_imports
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "sie_imports_delete" ON public.sie_imports
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- sie_account_mappings
+CREATE POLICY "sie_account_mappings_select" ON public.sie_account_mappings
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "sie_account_mappings_insert" ON public.sie_account_mappings
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "sie_account_mappings_update" ON public.sie_account_mappings
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "sie_account_mappings_delete" ON public.sie_account_mappings
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- calendar_feeds
+CREATE POLICY "calendar_feeds_select" ON public.calendar_feeds
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "calendar_feeds_insert" ON public.calendar_feeds
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "calendar_feeds_update" ON public.calendar_feeds
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "calendar_feeds_delete" ON public.calendar_feeds
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- chat_sessions
+CREATE POLICY "chat_sessions_select" ON public.chat_sessions
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "chat_sessions_insert" ON public.chat_sessions
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "chat_sessions_update" ON public.chat_sessions
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "chat_sessions_delete" ON public.chat_sessions
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- chat_messages
+CREATE POLICY "chat_messages_select" ON public.chat_messages
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "chat_messages_insert" ON public.chat_messages
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "chat_messages_update" ON public.chat_messages
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "chat_messages_delete" ON public.chat_messages
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- ai_usage_tracking (SELECT + INSERT only — no UPDATE/DELETE policy)
+CREATE POLICY "ai_usage_tracking_select" ON public.ai_usage_tracking
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "ai_usage_tracking_insert" ON public.ai_usage_tracking
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+
+-- extension_data
+CREATE POLICY "extension_data_select" ON public.extension_data
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "extension_data_insert" ON public.extension_data
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "extension_data_update" ON public.extension_data
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "extension_data_delete" ON public.extension_data
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- api_keys
+CREATE POLICY "api_keys_select" ON public.api_keys
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "api_keys_insert" ON public.api_keys
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "api_keys_update" ON public.api_keys
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "api_keys_delete" ON public.api_keys
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- skatteverket_tokens
+CREATE POLICY "skatteverket_tokens_select" ON public.skatteverket_tokens
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "skatteverket_tokens_insert" ON public.skatteverket_tokens
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "skatteverket_tokens_update" ON public.skatteverket_tokens
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "skatteverket_tokens_delete" ON public.skatteverket_tokens
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- pending_operations (SELECT + UPDATE only — inserts via service role)
+CREATE POLICY "pending_operations_select" ON public.pending_operations
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "pending_operations_update" ON public.pending_operations
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+
+-- payment_match_log (nullable company_id)
+CREATE POLICY "payment_match_log_select" ON public.payment_match_log
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "payment_match_log_insert" ON public.payment_match_log
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id() OR company_id IS NULL);
+
+-- event_log (SELECT only for users — writes via handler in service role)
+CREATE POLICY "event_log_select" ON public.event_log
+  FOR SELECT USING (company_id = public.current_active_company_id());
+
+-- notification_log (nullable company_id for system-wide notifications)
+CREATE POLICY "notification_log_select" ON public.notification_log
+  FOR SELECT USING (company_id = public.current_active_company_id() OR company_id IS NULL);
+
+-- audit_log (SELECT only for users — writes via SECURITY DEFINER triggers)
+CREATE POLICY "audit_log_select" ON public.audit_log
+  FOR SELECT USING (company_id = public.current_active_company_id());
+
+-- provider_consents
+CREATE POLICY "provider_consents_select" ON public.provider_consents
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "provider_consents_insert" ON public.provider_consents
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "provider_consents_update" ON public.provider_consents
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "provider_consents_delete" ON public.provider_consents
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- voucher_gap_explanations (preserves the owner/admin team_members check)
+CREATE POLICY "voucher_gap_explanations_select" ON public.voucher_gap_explanations
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "voucher_gap_explanations_insert" ON public.voucher_gap_explanations
+  FOR INSERT WITH CHECK (
+    company_id = public.current_active_company_id()
+    AND EXISTS (
+      SELECT 1 FROM public.team_members tm
+      JOIN public.companies c ON c.team_id = tm.team_id
+      WHERE c.id = company_id
+        AND tm.user_id = auth.uid()
+        AND tm.role IN ('owner', 'admin')
+    )
+  );
+CREATE POLICY "voucher_gap_explanations_update" ON public.voucher_gap_explanations
+  FOR UPDATE USING (
+    company_id = public.current_active_company_id()
+    AND EXISTS (
+      SELECT 1 FROM public.team_members tm
+      JOIN public.companies c ON c.team_id = tm.team_id
+      WHERE c.id = company_id
+        AND tm.user_id = auth.uid()
+        AND tm.role IN ('owner', 'admin')
+    )
+  );
+
+-- automation_webhooks
+CREATE POLICY "automation_webhooks_select" ON public.automation_webhooks
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "automation_webhooks_insert" ON public.automation_webhooks
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "automation_webhooks_update" ON public.automation_webhooks
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "automation_webhooks_delete" ON public.automation_webhooks
+  FOR DELETE USING (company_id = public.current_active_company_id());
+
+-- email_connections
+CREATE POLICY "email_connections_select" ON public.email_connections
+  FOR SELECT USING (company_id = public.current_active_company_id());
+CREATE POLICY "email_connections_insert" ON public.email_connections
+  FOR INSERT WITH CHECK (company_id = public.current_active_company_id());
+CREATE POLICY "email_connections_update" ON public.email_connections
+  FOR UPDATE USING (company_id = public.current_active_company_id());
+CREATE POLICY "email_connections_delete" ON public.email_connections
+  FOR DELETE USING (company_id = public.current_active_company_id());
diff --git a/supabase/migrations/20260411130000_viewer_role_read_only.sql b/supabase/migrations/20260411130000_viewer_role_read_only.sql
new file mode 100644
index 00000000..c28dd5a5
--- /dev/null
+++ b/supabase/migrations/20260411130000_viewer_role_read_only.sql
@@ -0,0 +1,364 @@
+-- =============================================================================
+-- Viewer role read-only enforcement
+-- =============================================================================
+--
+-- Activates the `viewer` role in company_members. Until now the role existed
+-- in the type system (CompanyRole) but was dormant — a viewer had the same
+-- write capabilities as a member. This migration makes viewers truly
+-- read-only at the database level.
+--
+-- Mechanism:
+--   1. New helper `public.current_user_can_write()` returns true only if
+--      the authenticated user's role in the active company is NOT 'viewer'.
+--   2. Every INSERT / UPDATE / DELETE policy on company-scoped tables is
+--      recreated with an added `AND public.current_user_can_write()` clause.
+--   3. SELECT policies are left untouched — viewers read everything.
+--
+-- After this migration, any write by a viewer is rejected with:
+--   "new row violates row-level security policy" (server-side)
+-- regardless of whether it originates from the UI, a browser console, or
+-- an API key bound to a viewer's session.
+-- =============================================================================
+
+-- =============================================================================
+-- 1. current_user_can_write() helper
+-- =============================================================================
+CREATE OR REPLACE FUNCTION public.current_user_can_write()
+RETURNS boolean
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT EXISTS (
+    SELECT 1
+    FROM public.company_members cm
+    WHERE cm.user_id = auth.uid()
+      AND cm.company_id = public.current_active_company_id()
+      AND cm.role <> 'viewer'
+  );
+$$;
+
+GRANT EXECUTE ON FUNCTION public.current_user_can_write() TO authenticated;
+
+COMMENT ON FUNCTION public.current_user_can_write() IS
+  'Returns true if auth.uid() has a non-viewer role (owner / admin / member) '
+  'in the current active company. Used by RLS INSERT/UPDATE/DELETE policies '
+  'to make the ''viewer'' role truly read-only. Viewers, non-members, and '
+  'unauthenticated callers all get false.';
+
+-- =============================================================================
+-- 2. Standard tables — recreate INSERT / UPDATE / DELETE policies
+-- =============================================================================
+-- Loop over all company-scoped tables that currently have the full set of
+-- insert/update/delete policies. SELECT policies are left alone (viewers
+-- must be able to read everything).
+
+DO $$
+DECLARE
+  t TEXT;
+  standard_tables TEXT[] := ARRAY[
+    'company_settings', 'chart_of_accounts', 'fiscal_periods', 'journal_entries',
+    'transactions', 'bank_connections', 'bank_file_imports',
+    'customers', 'invoices', 'invoice_reminders', 'invoice_payments',
+    'suppliers', 'supplier_invoices', 'supplier_invoice_payments',
+    'receipts', 'document_attachments', 'invoice_inbox_items',
+    'categorization_templates', 'deadlines', 'cost_centers', 'projects',
+    'sie_imports', 'sie_account_mappings', 'calendar_feeds',
+    'chat_sessions', 'chat_messages',
+    'extension_data', 'api_keys', 'skatteverket_tokens',
+    'provider_consents', 'automation_webhooks', 'email_connections'
+  ];
+BEGIN
+  FOREACH t IN ARRAY standard_tables
+  LOOP
+    IF EXISTS (
+      SELECT 1 FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_name = t
+    ) THEN
+      EXECUTE format('DROP POLICY IF EXISTS "%s_insert" ON public.%I', t, t);
+      EXECUTE format('DROP POLICY IF EXISTS "%s_update" ON public.%I', t, t);
+      EXECUTE format('DROP POLICY IF EXISTS "%s_delete" ON public.%I', t, t);
+
+      EXECUTE format(
+        'CREATE POLICY "%s_insert" ON public.%I '
+        'FOR INSERT WITH CHECK ('
+        'company_id = public.current_active_company_id() '
+        'AND public.current_user_can_write())',
+        t, t
+      );
+      EXECUTE format(
+        'CREATE POLICY "%s_update" ON public.%I '
+        'FOR UPDATE USING ('
+        'company_id = public.current_active_company_id() '
+        'AND public.current_user_can_write())',
+        t, t
+      );
+      EXECUTE format(
+        'CREATE POLICY "%s_delete" ON public.%I '
+        'FOR DELETE USING ('
+        'company_id = public.current_active_company_id() '
+        'AND public.current_user_can_write())',
+        t, t
+      );
+    END IF;
+  END LOOP;
+END $$;
+
+-- =============================================================================
+-- 3. voucher_sequences (INSERT + UPDATE only, no DELETE policy)
+-- =============================================================================
+DROP POLICY IF EXISTS "voucher_sequences_insert" ON public.voucher_sequences;
+DROP POLICY IF EXISTS "voucher_sequences_update" ON public.voucher_sequences;
+CREATE POLICY "voucher_sequences_insert" ON public.voucher_sequences
+  FOR INSERT WITH CHECK (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "voucher_sequences_update" ON public.voucher_sequences
+  FOR UPDATE USING (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+
+-- =============================================================================
+-- 4. mapping_rules (standard, but with OR company_id IS NULL on SELECT only)
+-- =============================================================================
+-- The SELECT policy keeps its OR company_id IS NULL exception for system
+-- rules — viewers can still read them. Writes drop the NULL branch because
+-- viewers never create rules (and non-viewers only create company-scoped
+-- rules, not system rules).
+DROP POLICY IF EXISTS "mapping_rules_insert" ON public.mapping_rules;
+DROP POLICY IF EXISTS "mapping_rules_update" ON public.mapping_rules;
+DROP POLICY IF EXISTS "mapping_rules_delete" ON public.mapping_rules;
+CREATE POLICY "mapping_rules_insert" ON public.mapping_rules
+  FOR INSERT WITH CHECK (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "mapping_rules_update" ON public.mapping_rules
+  FOR UPDATE USING (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "mapping_rules_delete" ON public.mapping_rules
+  FOR DELETE USING (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+
+-- =============================================================================
+-- 5. ai_usage_tracking (INSERT only)
+-- =============================================================================
+DROP POLICY IF EXISTS "ai_usage_tracking_insert" ON public.ai_usage_tracking;
+CREATE POLICY "ai_usage_tracking_insert" ON public.ai_usage_tracking
+  FOR INSERT WITH CHECK (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+
+-- =============================================================================
+-- 6. pending_operations (UPDATE only — inserts via service role)
+-- =============================================================================
+DROP POLICY IF EXISTS "pending_operations_update" ON public.pending_operations;
+CREATE POLICY "pending_operations_update" ON public.pending_operations
+  FOR UPDATE USING (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+  );
+
+-- =============================================================================
+-- 7. payment_match_log (INSERT only, nullable company_id)
+-- =============================================================================
+DROP POLICY IF EXISTS "payment_match_log_insert" ON public.payment_match_log;
+CREATE POLICY "payment_match_log_insert" ON public.payment_match_log
+  FOR INSERT WITH CHECK (
+    (company_id = public.current_active_company_id() OR company_id IS NULL)
+    AND public.current_user_can_write()
+  );
+
+-- =============================================================================
+-- 8. Child tables — join to parent via EXISTS
+-- =============================================================================
+-- journal_entry_lines
+DROP POLICY IF EXISTS "journal_entry_lines_insert" ON public.journal_entry_lines;
+DROP POLICY IF EXISTS "journal_entry_lines_update" ON public.journal_entry_lines;
+DROP POLICY IF EXISTS "journal_entry_lines_delete" ON public.journal_entry_lines;
+CREATE POLICY "journal_entry_lines_insert" ON public.journal_entry_lines
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "journal_entry_lines_update" ON public.journal_entry_lines
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "journal_entry_lines_delete" ON public.journal_entry_lines
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.journal_entries je
+            WHERE je.id = journal_entry_lines.journal_entry_id
+              AND je.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+
+-- invoice_items
+DROP POLICY IF EXISTS "invoice_items_insert" ON public.invoice_items;
+DROP POLICY IF EXISTS "invoice_items_update" ON public.invoice_items;
+DROP POLICY IF EXISTS "invoice_items_delete" ON public.invoice_items;
+CREATE POLICY "invoice_items_insert" ON public.invoice_items
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "invoice_items_update" ON public.invoice_items
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "invoice_items_delete" ON public.invoice_items
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.invoices i
+            WHERE i.id = invoice_items.invoice_id
+              AND i.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+
+-- supplier_invoice_items
+DROP POLICY IF EXISTS "supplier_invoice_items_insert" ON public.supplier_invoice_items;
+DROP POLICY IF EXISTS "supplier_invoice_items_update" ON public.supplier_invoice_items;
+DROP POLICY IF EXISTS "supplier_invoice_items_delete" ON public.supplier_invoice_items;
+CREATE POLICY "supplier_invoice_items_insert" ON public.supplier_invoice_items
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "supplier_invoice_items_update" ON public.supplier_invoice_items
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "supplier_invoice_items_delete" ON public.supplier_invoice_items
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.supplier_invoices si
+            WHERE si.id = supplier_invoice_items.supplier_invoice_id
+              AND si.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+
+-- receipt_line_items
+DROP POLICY IF EXISTS "receipt_line_items_insert" ON public.receipt_line_items;
+DROP POLICY IF EXISTS "receipt_line_items_update" ON public.receipt_line_items;
+DROP POLICY IF EXISTS "receipt_line_items_delete" ON public.receipt_line_items;
+CREATE POLICY "receipt_line_items_insert" ON public.receipt_line_items
+  FOR INSERT WITH CHECK (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "receipt_line_items_update" ON public.receipt_line_items
+  FOR UPDATE USING (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+CREATE POLICY "receipt_line_items_delete" ON public.receipt_line_items
+  FOR DELETE USING (
+    EXISTS (SELECT 1 FROM public.receipts r
+            WHERE r.id = receipt_line_items.receipt_id
+              AND r.company_id = public.current_active_company_id())
+    AND public.current_user_can_write()
+  );
+
+-- =============================================================================
+-- 9. voucher_gap_explanations (preserves owner/admin team_members check)
+-- =============================================================================
+-- The existing policy already blocks non-(owner|admin) via team_members, so
+-- viewers are de facto blocked. We add current_user_can_write() as a
+-- defensive second layer so a future refactor of team_members can't
+-- accidentally re-open viewer writes.
+DROP POLICY IF EXISTS "voucher_gap_explanations_insert" ON public.voucher_gap_explanations;
+DROP POLICY IF EXISTS "voucher_gap_explanations_update" ON public.voucher_gap_explanations;
+CREATE POLICY "voucher_gap_explanations_insert" ON public.voucher_gap_explanations
+  FOR INSERT WITH CHECK (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+    AND EXISTS (
+      SELECT 1 FROM public.team_members tm
+      JOIN public.companies c ON c.team_id = tm.team_id
+      WHERE c.id = company_id
+        AND tm.user_id = auth.uid()
+        AND tm.role IN ('owner', 'admin')
+    )
+  );
+CREATE POLICY "voucher_gap_explanations_update" ON public.voucher_gap_explanations
+  FOR UPDATE USING (
+    company_id = public.current_active_company_id()
+    AND public.current_user_can_write()
+    AND EXISTS (
+      SELECT 1 FROM public.team_members tm
+      JOIN public.companies c ON c.team_id = tm.team_id
+      WHERE c.id = company_id
+        AND tm.user_id = auth.uid()
+        AND tm.role IN ('owner', 'admin')
+    )
+  );
+
+-- =============================================================================
+-- 10. Conditional tables (may not exist on fresh DBs)
+-- =============================================================================
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.tables
+    WHERE table_schema = 'public' AND table_name = 'account_balances'
+  ) THEN
+    EXECUTE 'DROP POLICY IF EXISTS "account_balances_insert" ON public.account_balances';
+    EXECUTE 'DROP POLICY IF EXISTS "account_balances_update" ON public.account_balances';
+    EXECUTE 'DROP POLICY IF EXISTS "account_balances_delete" ON public.account_balances';
+    EXECUTE 'CREATE POLICY "account_balances_insert" ON public.account_balances FOR INSERT WITH CHECK (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+    EXECUTE 'CREATE POLICY "account_balances_update" ON public.account_balances FOR UPDATE USING (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+    EXECUTE 'CREATE POLICY "account_balances_delete" ON public.account_balances FOR DELETE USING (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+  END IF;
+END $$;
+
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.tables
+    WHERE table_schema = 'public' AND table_name = 'salary_payments'
+  ) THEN
+    EXECUTE 'DROP POLICY IF EXISTS "salary_payments_insert" ON public.salary_payments';
+    EXECUTE 'DROP POLICY IF EXISTS "salary_payments_update" ON public.salary_payments';
+    EXECUTE 'DROP POLICY IF EXISTS "salary_payments_delete" ON public.salary_payments';
+    EXECUTE 'CREATE POLICY "salary_payments_insert" ON public.salary_payments FOR INSERT WITH CHECK (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+    EXECUTE 'CREATE POLICY "salary_payments_update" ON public.salary_payments FOR UPDATE USING (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+    EXECUTE 'CREATE POLICY "salary_payments_delete" ON public.salary_payments FOR DELETE USING (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+  END IF;
+END $$;
+
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.tables
+    WHERE table_schema = 'public' AND table_name = 'mileage_entries'
+  ) THEN
+    EXECUTE 'DROP POLICY IF EXISTS "mileage_entries_insert" ON public.mileage_entries';
+    EXECUTE 'DROP POLICY IF EXISTS "mileage_entries_update" ON public.mileage_entries';
+    EXECUTE 'DROP POLICY IF EXISTS "mileage_entries_delete" ON public.mileage_entries';
+    EXECUTE 'CREATE POLICY "mileage_entries_insert" ON public.mileage_entries FOR INSERT WITH CHECK (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+    EXECUTE 'CREATE POLICY "mileage_entries_update" ON public.mileage_entries FOR UPDATE USING (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+    EXECUTE 'CREATE POLICY "mileage_entries_delete" ON public.mileage_entries FOR DELETE USING (company_id = public.current_active_company_id() AND public.current_user_can_write())';
+  END IF;
+END $$;