The same product, four refactors on — each graph shipped before the next was drawn.
Every query carries the tenant id, and Postgres enforces role AND tenant on every row. The client is never trusted to filter — isolation is a database guarantee, not an application habit.
Translates one search into four tenant-scoped reads — past cases, how they resolved, steward notes, and the agreement itself — and returns them together, so a search for “Attendance” surfaces the whole cluster.
→ A multi-tenant system for members' data earns trust with proof, not promises
→ Every schema change ships with an isolation test before it ships to a Local
| cross_tenant_admin_read | role + tenant | FAIL @ 0040 | PASS @ 0041 |
| anon_lookup_scope | single row, no enumeration | PASS | PASS |
| steward_case_read | member-gated | PASS | PASS |
| knowledge_admin_read | whole-Local memory | PASS | PASS |
Paper files, one binder, and whatever the retiring steward remembers
The workflow the app enforces — interrupts are the moments a human must decide; nothing irreversible happens without one.