Cost is the most sensitive data in the system
Hourly cost is salary in the open, and it's treated as such: it has its own permission, separate from everything else. Those without it don't see it — not on screen, not in reports, not in exports. And every change to a cost is recorded.