A working demo by Laurence Rugley. Pick a role below: the server sends each one only the people and figures that role may see. Try Chief HR Officer, then President, then Finance Director, and watch "Your browser received" change.
The server picks the people this role may see first, and every total is computed from that set only. Nothing is hidden in the browser; it simply never arrives. Here you can switch roles freely, because that's the demo. In a real deployment the role comes from your sign-in.
For each role that may not see them, pay, exit reasons and employee relations cases are removed before anything is sent. Switch to Finance Director and open "See exactly what your browser received": no pay figure, exit reason or employee relations case is in it.
HR roles see everything. For the others (President, Finance Director, Assembly Manager): if any slice of a sensitive breakdown (exit reasons, pay, HR case types) would cover fewer than 5 people, that role gets the total only, so no one person's details can be worked out from the numbers. Their own record is left out of their view.