Why tenant scoping belongs in the model layer, not the view
Every multi-tenant leak we have seen started the same way — a query that forgot which customer it was for. The fix is not more discipline. It is making the forgetful version impossible to write.
The ZivoHR engineering team
Engineering
12 Aug 2026 · 6 min read