Database-enforced isolation

Tenants are kept apart at the database itself with row-level security, not by app-layer filtering you have to trust. Key points:

• The guarantee holds even if application code has a bug.
• This is the most defensible part of the platform's security story.