Searches are campaign-scoped, need at least three characters, and are audited. Broad queries alert the data-stewardship team.