If two customers share a deployment, every read and write has to name the tenant. A missing filter is a data breach, not a bug you patch after the demo.
The tenant is not a hint
Pass the tenant id from the authenticated account into the query. Do not trust an id from the request body. A list endpoint that forgets the filter will happily return the other customer’s invoices, and the tests that use one tenant will stay green.
Indexes include the tenant
The common lookup is tenant plus reference, or tenant plus status. An index on status alone scans everyone’s rows to find yours. Write the index the way the query is written.
Files and caches too
Object keys and cache keys need the tenant in the path. A signed URL for one customer must not be guessable as another customer’s file. The same rule applies to search indexes and to anything an agent is allowed to retrieve.
What to do this week
- Add a test with two tenants and assert the cross read is empty.
- Put the tenant column on the hot indexes.
- Prefix file and cache keys with the tenant.