# Business Trip approval documents contain sensitive HR content and use a predictable
# filename (request number), so direct web access is blocked entirely - every download must
# go through business_trip_request/document.php, which re-checks view permission on each
# request.
Require all denied
