Security
Row-level security
Tamanor runs tenant queries through a non-superuser role with FORCE row-level security and a transaction-local tenant context — defense in depth beneath application checks.
Database-enforced, transaction-local
The runtime database role is a non-superuser without the ability to bypass row-level security. FORCE ROW LEVEL SECURITY is on, and the active tenant is set per transaction, so isolation travels with each unit of work.
This is defense in depth: even if an application query omitted a tenant filter, the database still returns only the active tenant's rows.
Frequently asked questions
- What if application code forgets a tenant filter?
- Row-level security still restricts results to the active tenant; isolation does not depend on remembering to filter.