Skip to main content

Expense Database Tenant Isolation

Summary​

Global query filters cover ExpenseClaim, ExpenseReceiptReference, audit, and timeline. Runtime predicates use current tenant context, with confirmed privileged/design-time bypass behavior. Missing runtime tenant prevents tenant-required commands.

Audience​

Backend developers, database reviewers, QA, architects, DevOps, support, and implementation teams.

Confirmed persistence​

Global query filters cover ExpenseClaim, ExpenseReceiptReference, audit, and timeline. Runtime predicates use current tenant context, with confirmed privileged/design-time bypass behavior. Missing runtime tenant prevents tenant-required commands.

Confirmed: scoped filters, explicit tenant columns, command tenant requirement, and privileged/design-time bypass.

Requires confirmation: universal endpoint authorization, operational-store access, forwarded-context trust, administrative governance, raw-query behavior, backup isolation, and assurance outside EF filters.

Requires confirmation​

Production migration governance, retention, archival, masking, performance targets, concurrency roadmap, operational-store access, and rollback ownership remain unconfirmed unless narrowed above.

Source References​

  • microservices/src/expense-service/Infrastructure/ExpenseDbContext.cs
  • microservices/src/expense-service/Infrastructure/Persistence.cs

See Also​

Keywords​

  • Expense database
  • Tenant Isolation

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-16
  • Review cycle: Quarterly