Tenant guards in functions
Resolve the actor first, then query with an index — never trust client-sent tenant ids alone.
Difficulty 3/5
Plain English
Multi-tenant apps filter every read/write by tenantId or organizationId. The pattern is getTenantUser / getActor at the top of each mutation, then .withIndex(...).
Analogy
Check ID at the door before opening any drawer.
Jessica's wedding portal
organizationId + role checks for client vs team routes.
Agentify CRM
tenantId + security isolation scripts when schema changes.
Go deeper
Server picks the scope.
Common mistakes
- Optional tenantId on mutations.
- Admin queries copied to user UI.
AI-agent trap
ctx.db.query('messages').collect() without tenant filter.
Summary
Avoid .filter on hot paths; use indexes.
Confidence: