Multi-tenant organizations (Postgres RLS)

Organizations isolate their data from each other using Postgres row-level security (RLS) enforced at the database layer, not just in application code — so a bug in a query can't leak one tenant's rows into another's.

• You're setting up a second organization/team on a shared deployment
• You're reviewing the security model behind a multi-tenant SaaS claim
• You're debugging why a query returns fewer rows than expected in a tenant-scoped table

Every tenant-scoped table carries a tenant_node_id; the application connects as the non-superuser app_rls Postgres role with FORCE RLS policies enabled, so the database itself refuses cross-tenant rows even if application code forgets a WHERE clause.