Add requireGroup('Admin', 'Leadership') as router-level middleware on all VCL multi-vertical routes. Hide the CCP Metrics nav item from users not in those groups and guard the page render in App.js with a redirect fallback.