The one query that forgot the tenant
Every query in this codebase filters by tenant. Four hundred of them do it correctly. One report added last month doesn't, and it returned another customer's rows.
The rule is real and it lives in four hundred places, which means it holds only as long as nobody forgets — and forgetting is silent, because a query missing the filter runs perfectly well.
Move the tenant rule somewhere it can't be forgotten.
Components — tap one, then tap a slot on the diagram
!One report out of four hundred queries omitted the tenant filter and returned another customer's rows.
Boundaries, outermost first: Database: All tenants' rows Outside every boundary: 400 queries (filter correctly), The new report (forgot to; FAILED: no filter), an empty slot for the inside the database Connections: 400 queries calls inside the database (step 1) The new report calls inside the database — filtered anyway (step 2) inside the database calls All tenants' rows (step 3)
400 queriesfilter correctly
The new reportforgot tono filter
All tenants' rows