A tenant identifier in a database row does not prove that one customer's data stays separate from another's.

The boundary must hold through search, direct records, file previews, background jobs, caches, and exports.

Map every path and check the runtime roles and pooled connections that actually carry requests, not just a filtered list view.

Create two deliberately similar synthetic customers. Try crossing their identifiers and changing access while work is waiting.

Save both allowed and denied results, and explain the boundaries still untested. Isolation is a property to demonstrate across the workflow, rather than a column name to point at.

Original article explainer. AI-assisted conceptual illustration and neural narration; original synthesized music. Not a human recording or customer result.