Per-tenant data isolation at the schema level

11 September 2026 · Status: In verification

What changed

• Every tenant-owned table carries a tenant scope, with matching tables for organisation members and entitlements.
• Tenant access resolves from the signed-in organisation, never from a browser cookie.
• A suspended tenant denies its members at the gate rather than by a flag checked deeper in the stack.
• Staged backfill plan and pure isolation guards are covered by tests, and the whole thing is schema-pushed behind feature flags.