The tenant boundaryis the security boundary.

01 · Tenant isolation

Enforced where it cannot be forgotten.

Every database query is scoped to the caller's organisation at the repository layer. The organisation identifier is resolved from the authenticated principal's claims and never from a request body or URL, so a caller cannot name someone else's tenant.

The test suite attempts cross-tenant reads and requires them to fail. A record belonging to another organisation is reported as not found rather than forbidden, so its existence is not disclosed.

A second line of defence sits in the persistence layer: a save of any tenant-owned record with no tenant is refused outright, which fails the day someone wires a new endpoint without a scope rather than leaking quietly.

02 · Auditing and PHI

Records that access happened, never the data.

The audit log is insert-only: the application role holds no UPDATE or DELETE grant on it. Entries record who, what action, which resource, which organisation, from where, when and the outcome — and for PHI-touching reads, the subject identifier.

The log records that access happened; it never contains the protected health information itself.

A PHI redaction enricher strips sensitive patterns from structured log output before it reaches any sink, verified by a test asserting that a known PHI string never appears in the log stream.

03 · Engineering controls

Gates, not intentions.

The static analysis gate is itself self-tested on every run against engineered fixtures, because a security check that silently stops failing is worse than no check at all.