Attendance Database Tenant Isolation

Summary

Attendance business, configuration, projection, snapshot, audit, and timeline objects carry tenant identifiers and are protected by context-level global query filters.

Audience

• Backend developers, security reviewers, QA engineers, and architects

Filter flow

Twelve modeled object types have filters of privileged context or current tenant equality. The outbox is the exception. Repository queries normally inherit filters, while privileged context can bypass them as confirmed in the context model.

Uniqueness is tenant-scoped for snapshots, weekly offs, and default policies; policy-rule uniqueness is parent-scoped. Shift compatibility identity and outbox event identity are global. Attendance employee/date is indexed but not uniquely enforced.

Raw SQL readers and backfill contexts do not gain universal protection from these filters. They require explicit tenant predicates, read-only source handling, and reconciliation review. This design is a defense layer, not a claim of universal security assurance.

Source References

• microservices/src/attendance-service/Infrastructure/AttendanceDbContext.cs
• microservices/src/attendance-service/Infrastructure/Persistence.cs
• microservices/src/attendance-service/Backfill/ShiftPolicyBackfillTypes.cs

Related Articles

• Attendance database
• Attendance technical documentation
• Attendance API documentation

See Also

• Attendance business documentation
• Attendance overview

Keywords

• Attendance persistence
• EF Core
• PostgreSQL

Revision Information

• Status: Draft
• Last reviewed: 2026-07-15
• Review cycle: Quarterly