How it actually works
Each business-owned row carries a business id. The database tables have row-level security policies defined, but GorZesk’s own backend connects with a role those policies do not restrict, so RLS does not run against its traffic. The real protection is that the API checks the caller’s membership and role before any query touching a business runs.
For AI
The model never chooses which business to read. The system fixes the business from the authenticated session before any tool runs.
Test it
- Write a test that a user of business A cannot read or write business B.
- Test the negative path for every new table and endpoint.
Part of: Developer fundamentals
Next recommendedEvaluating an AI featureRelated
Last updated 2026-11-02. Something unclear or wrong? Tell us.