The dashboard's Google service account is only ever allowed to read sheet data — it can never write, edit, or delete anything in the source spreadsheets. This is enforced at the API level: every request uses the https://www.googleapis.com/auth/spreadsheets.readonly OAuth scope, defined once in netlify/functions/_utils/sheets.js and shared by every function below. A read-only-scoped credential is physically incapable of making write calls — Google's API rejects them before they reach the sheet, regardless of what the function code asks for.

Finance — the source sheet only lists the top 10 hotels per month, so Revenue MTD / Room Nights MTD / ADR are top-10 totals, not full-portfolio totals. A few hotels are priced in MYR instead of IDR; those are excluded from the IDR totals but still shown in the property table.

Revenue — the source sheet has no Traveloka column. "Rate Competitiveness" compares Imagination's IMAGTC rate against Agoda (the real OTA column present in the sheet); MG is also read as a secondary reference. Variance is calculated directly from IMAGTC vs Agoda, not from the sheet's own precomputed variance columns, which are based on a separate "5% Temporary" markup rate.

Sales — each calendar date is its own tab rather than a date column, so "bookings" are row counts within a date's tab and "active agents" are distinct "API Client" values seen this month.