Tenant isolation in the database
Every tenant-owned table carries PostgreSQL row-level security, enforced by the database rather than by application code remembering a WHERE clause. The application connects as a least-privilege runtime role that cannot bypass it.
