Tenant isolation

Every operational read and write is evaluated against the caller's authorized workspace using row-level security in the database, not only in application code. Authorization is fail-closed: unproven access is denied.

• A user only sees workspaces they are genuinely authorized for.
• An API key only reaches its own workspace, environment and granted programs.
• Laboratory operations and Partner API credentials are laboratory- and environment-scoped. Health Company views may combine only their authorized Programs across laboratories; linked patient access is separately authorized per laboratory and preserves its provenance.