# Field Trip approval documents contain sensitive HR content and use a predictable filename
# (request number), so direct web access is blocked entirely - every download must go
# through field_trip_request/document.php, which re-checks view permission on each request.
Require all denied
