Tenant isolation and access control

Why

An application filter is a line somebody can forget to write.

How

Postgres checks your membership and role on every read and write, including ones nobody thought about.

Rows and files

• Every table that holds organisation data carries an organisation id; a session sees only rows of organisations it belongs to.
• Every stored file path begins with the owning organisation's id, and the storage policies apply the same checks.
• Write policies are ranked: the catalogue needs engineer or above, settings and integrations admin or above, billing the owner.

Roles

Roles, lowest to highest: viewer, operator, sales, engineer, admin and owner. An operator works at stations and never sees a price. A role template gives a person their role, areas and stations in one step; see Users, roles and stations.

The last owner cannot be demoted or removed, and only an owner grants ownership. One login can belong to several organisations with a role in each, and a role in one grants nothing in another.

Elevated access on the server

A few server jobs act outside a user session: payment webhooks, import workers, the AI pipeline, scheduled jobs and the token links such as the quote portal. Each is scoped to one named organisation or one record, and the elevated key never reaches the browser.

Audit

Administrative actions, bulk catalogue edits included, are logged with the actor and what changed. The log is written by the server, so a user can cause an entry but never author or edit one.