The question behind the term
A tenant selector in a URL or interface is not an authorization boundary. Every query, object, job, cache key and derived projection can become a cross-tenant path when scope is accepted from untrusted input.
A reviewable approach
Resolve membership and active tenant context on the server, carry it through narrow repositories and enforce it again with forced row-level policy in non-bypass runtime roles. Return uniform denials that do not leak another tenant’s record existence.
- Never trust tenant IDs from request data
- Use transaction-local trusted scope
- Test cross-tenant reads, writes and side channels
- Separate platform operations from clinical browsing
The boundary to keep visible
Row-level security is one layer, not a complete privacy program. Operator privileges, backup access, object storage, search indexes, analytics and incident procedures need their own isolation evidence.