You run the buildings you have been given and nothing else. The manager's account is scoped to those buildings before a screen is drawn, so what you see is what you are responsible for — and the owner does not have to trust an interface to keep it that way.
The three screens this account opens on, captured from the product.



From the tenant's photograph to the engineer's phone
Four cheques, four states, one schedule
The contract, its signatures and its Ejari certificate
The inspection, the deductions and the evidence
What your tenant sees, on their own phone
The account carries its assigned buildings and the data is filtered against them before it reaches a screen, with row-level security in Postgres behind that. It is not a hidden menu item.
One unit, one record, and three accounts looking at it. What each of them can reach is decided in the database rather than by which screen they were sent to.