Isolation between clients is enforced in the engine, not entrusted to the code

When a platform serves several clients on the same database, there are two ways to make sure nobody sees anybody else’s data. The cheap one is filtering in the code: every query adds its condition and all is well as long as nobody forgets. The other is for the database not to return those rows, no matter what query arrives.

We do the second, and in forced mode: the rules apply to the table owner too, which is where the hole usually is. A badly written query does not return another client’s data; it returns nothing.

It was done in phase zero, before there were modules on top, alongside the common data model and the automated architecture checks. This is the difference between being born multi-client and adapting later, and it cannot be recovered afterwards: isolation added onto a model that did not plan for it always leaves one query loose.