I suppose you could also just lock down most of the fields themselves on the form based on role, but that's probably a less secure/certain way to do it and IMO would be more tedious to do. If your goal is that the rep shouldn't even be able to view customer data though, then you might have to go down that road anyways.