The decision that matters
Derive the active organization from a verified session and membership, then enforce it on record access. Apply the same boundary to exports, attachments, search and background jobs. Database row policies can add defense in depth, but the connection role and policy behavior matter. PostgreSQL documents important exceptions, including roles that bypass row security; enabling a feature is not proof that a particular query is protected.
A practical scenario
An invoice endpoint might correctly filter the listing by organization but fetch an individual invoice using only its identifier. A guessed or leaked identifier could then expose another tenant’s record. Test direct record URLs and action endpoints separately from the list page. Repeat the test for a user who has recently lost access.
Before you ship
- Use server-verified membership to establish tenant context.
- Test read, update, export and attachment paths across tenants.
- Review privileged database roles and background workers.
A useful next step
Create two isolated test organizations with similar records. Exercise the same operations as an owner, member and outsider. Keep these tests as regression coverage whenever a new route or integration touches shared data.
Primary reference & further reading
This guide combines general engineering recommendations with an illustrative scenario. Provider behavior can change; check current documentation before applying it. Read our editorial approach.