Security
Tenant isolation
Tamanor scopes every session and query to one active tenant, layering application permission checks over database row-level security, with system and runtime database access kept separate.
One active tenant, enforced twice
Sessions are tenant-scoped: a request carries exactly one active tenant. Application permission checks decide what a member may do, and PostgreSQL row-level security enforces which rows exist for that tenant at the database layer.
Cross-tenant system work (worker discovery, cleanup) uses a separate, narrow access path that is never used on a normal tenant request. The runtime tenant client and the system client are distinct by design.
Frequently asked questions
- Can one customer see another's data?
- No. Isolation is enforced by row-level security at the database layer, not only by application code.