How to design record-level security for cases so that agents can only see cases assigned to their team, while managers can see all cases in their region