Every record is owned
Workspace-owned tables carry a mandatory, indexed workspace reference with a foreign key. The server assigns it on write; a value supplied by a browser is discarded.
How isolation actually works
Multi-tenancy is a security property, so it is enforced in one place rather than remembered in many.
Four guarantees
Each one is enforced by the framework layer, not by individual features.
Every query is filtered
Reads pass through a global scope bound to the workspace resolved for the request. Updates and deletes re-check ownership even when a record was loaded elsewhere.
It fails closed
If a request reaches workspace data with no workspace bound, it raises an error instead of returning rows. Missing context can never widen a query.
Sources must agree
The hostname, the session and your membership all have to name the same workspace. A mismatch is refused, and an unknown id answers "not found" rather than "forbidden".
Platform staff access
Support access is possible, but never quiet.
Explicit and expiring
An operator must state a reason to start an impersonation session, and the session expires automatically rather than lasting until sign-out.
Visible and logged
The impersonated session shows a banner, and the event is written to both the platform audit log and your workspace audit log.
Ready to set up your workspace?
Create it now, or talk to us about migrating an existing system.