Salesforce Data Restriction Setup

I need a seasoned Salesforce professional to lock down contact visibility and block bulk data exports before our next sales cycle.

Here is what I am trying to achieve:

• Contact access must be limited strictly by role. A user should only see contacts that live inside the accounts that are relevant to their position. No cross-team visibility leaks.
• The affected audience is our standard users; admins and system integrators keep full access.
• Mass-export safeguards are critical. Please disable every native export avenue you can (reports, Data Loader, list views, etc.), and put event monitoring or similar alerting in place so any unusual extract attempt is flagged instantly. I’m also open to other techniques you recommend.

Acceptance criteria
1. Sharing rules, role hierarchy, permission sets, and any Apex or Territory settings you introduce must allow me to impersonate each standard user role and confirm they see only their own accounts’ contacts.
2. All export buttons and APIs that a standard user could reach are either removed or return an authorization error, and event monitoring captures any export attempts in real time.
3. A short hand-off document outlining the changes, where to adjust them, and how to extend the model as we grow.

We run Lightning Enterprise and prefer native features first, but I’m fine with lightweight code if it keeps performance intact. Let me know your estimated timeline and any preliminary questions so we can secure the org quickly.