Tenant isolation is enforced by the database, not by application code
Live, test-pinnedA query written incorrectly cannot return another organization’s rows. The isolation does not depend on every developer remembering to add a filter.
How it is enforced
Every domain table carries tenant_id NOT NULL under Postgres Row-Level Security with FORCE ROW LEVEL SECURITY, keyed on a transaction-local GUC. A privilege split means the runtime role cannot bypass RLS, a boot-time assertion refuses to start in production if a service connects as a superuser or BYPASSRLS role, and CI fails any migration that creates a domain table without RLS.
White paper — Tenant isolation




