Business Adjacent · Flight Log · FL-028
·platform·locked
Tenant isolation is structural, not a checklist
Signal
Multi-tenant trust dies on one cross-tenant leak. Discipline alone cannot carry that load.
Wrong turn
Rely on every handler remembering to filter by tenant by hand.
Correction
Auto-scoping wrappers, schema without silent defaults, line-anchored cross-tenant markers, and a deploy gate that refuses unscoped access.
A platform that consolidates vendor stacks must make client-to-client leakage a closed category, not a code-review hope.
The stack is layered on purpose: the request path injects scope, the schema rejects tenant-less writes, legitimate global jobs declare why they cross, and the build fails if a new path forgets. The first real gate run usually finds more than the manual sweep that inspired it.
For a stranger reading this log: the product promise is not "we try hard." It is "the factory will not ship an unscoped path."