Row-level security is a design decision

Every multi-tenant product has the same bug waiting in it. Someone writes a query, forgets the clause that scopes it to the current workspace, and ships. The page works. It works beautifully, in fact, because now it returns rows from everywhere.

You can try to prevent this with review. You will not succeed forever, because the failure mode is an absence, and absences are the hardest thing to notice in a diff.

Two places to put the rule

Put authorization in the query, and correctness depends on every author remembering, every time, in every code path, including the one added at the end of a long day.

Put it in the database as row-level security, and the rule is enforced under every query whether the author remembered or not. A page that forgets its filter returns nothing. An empty screen is a bug report. Someone else's data is an incident.

That difference is the whole argument. Not elegance, not purity. The cost of the same mistake.

What it takes to actually hold

Turning the feature on is not the work. Three things around it are.

A dedicated database role that the application connects as, with no ability to bypass the policies. If the application connects as the owner, the policies are decoration.

A reserved connection per request. Tenant context is set per connection, and a pooled connection handed to the next request while still carrying the previous tenant is the exact leak the policies were supposed to prevent. This one is easy to miss because it only appears under concurrency, which is to say never in development.

A self-test at boot that tries a cross-tenant read and refuses to serve traffic if it succeeds. Policies are code, code gets edited, and a policy that silently stopped applying looks identical to one that works. The test is twenty lines and it is the only thing that tells you the guarantee is still true today.

The part that is design, not plumbing

Deciding this is not a database decision made after the product is drawn. It changes what the product is allowed to be.

On a platform whose content is private messages between strangers, the shape of the failure is the shape of the trust. I would rather ship a screen that shows nothing and looks broken than one that shows the right amount of the wrong person's work. That is a product decision, and it belongs at the beginning.