Security

Tenant isolation

Every query includes tenant_id derived from membership of the authenticated user. Client-supplied org ids are never trusted alone.