diff --git a/app/Filament/Tenant/Resources/WorkOrderResource.php b/app/Filament/Tenant/Resources/WorkOrderResource.php
index f0df425..1ca8f7c 100644
--- a/app/Filament/Tenant/Resources/WorkOrderResource.php
+++ b/app/Filament/Tenant/Resources/WorkOrderResource.php
@@ -247,10 +247,9 @@ class WorkOrderResource extends Resource
     }
 
     /**
-     * Apply per-user visibility based on the permissions matrix:
-     *   admin/owner        → all work orders
-     *   work_orders.view_all → all work orders
-     *   view_own_assigned only → only WOs where master_id = current user
+     * Mechanics see only WOs assigned to them.
+     * Everyone else (admin, manager, receptionist, accountant, viewer) sees all.
+     * TenantScope already filters by company_id, so no cross-tenant leak is possible.
      */
     public static function getEloquentQuery(): Builder
     {
@@ -258,12 +257,12 @@ class WorkOrderResource extends Resource
         $user  = auth()->user();
 
         if (! $user) return $query->whereRaw('0 = 1');
-        if ($user->isAdmin()) return $query;
-        if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_ALL)) return $query;
-        if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_OWN_ASSIGNED)) {
+
+        // Mechanic role: show only WOs where they are the assigned master.
+        if ($user->isMechanic()) {
             return $query->where('master_id', $user->id);
         }
 
-        return $query->whereRaw('0 = 1');
+        return $query;
     }
 }