Cross-tenant leaks must be impossible by construction
Context
A multi-tenant platform consolidates vendor stacks. One cross-tenant leak kills trust.
What went wrong
Relying on every handler to remember tenant filters does not scale. Discipline alone cannot carry that load.
What we changed
I made isolation structural: auto-scoping wrappers, schema without silent tenant defaults, explicit markers for rare global jobs, and a deploy gate that refuses unscoped access.
Result
Unscoped paths fail the build. The promise is not "we try hard." It is "this class cannot ship."