LMS Database Tenant Isolation

Summary

Source-backed EF query-filter, elevated bypass, and tenant-integrity reference.

Audience

Engineering, QA, architecture, security, product, and governance reviewers.

Reference Content

Fifteen TenantEntity types receive a common tenant index and global query filter. Audit and timeline define equivalent filters, producing 17 filtered object types. Writes usually set tenant fields from request context; related objects copy the parent tenant.

Processed-event and outbox objects do not have global tenant filters. Their tenant representation also differs. This distinction is material and must not be treated as equivalent isolation.

The filter includes an elevated-context bypass. No endpoint policy governing that capability is declared in Training Service. Development seeding explicitly bypasses filters but adds explicit tenant predicates. No other filter bypass was found in Training code.

Foreign keys are based on object identifiers rather than tenant-plus-identifier composites. Same-tenant parent/child alignment therefore relies on application assignment, not composite database constraints.

Source References

• microservices/src/training-service/Application/Common.cs
• microservices/src/training-service/Infrastructure/TrainingDbContext.cs
• microservices/src/training-service/Infrastructure/DevelopmentSeeder.cs

Related Articles

• LMS database documentation
• LMS technical documentation

See Also

• Schema reference
• Database testing guide

Keywords

• LMS database
• Training persistence
• Source-backed model

Revision Information

• Status: Draft
• Last reviewed: 2026-07-17
• Review cycle: Quarterly