Problem: Before launch, the storage/schema layer needs an explicit confirmation that no tenant can query or see another tenant's data — this shouldn't be assumed from the application-layer isolation alone.
Area: Platform / Security
Proposal: Audit every table/store touched by the rental product for tenant-scoping, confirming every query is scoped by tenant at the data-access layer, not only in application logic.
Deliverables:
- A written audit report, with any gap found fixed before this issue closes.
Acceptance criteria:
Boundaries:
Part of #4778.
Reconciliation decision (#5669, resolved 2026-07-15): #5218 and #5219 are already closed -- read their findings first, don't redo that discovery work. This issue is a narrower audit scoped to the rental product's own stores specifically (query-layer tenant-scoping for what Rent-a-Loop itself touches), building on what #5218/#5219 already found for AMS's broader global-singleton/telemetry surfaces. #4939 (tenant-scoping columns) remains this milestone's own deliverable and is already natively blocked-by this issue, #4793, and #4783.
Problem: Before launch, the storage/schema layer needs an explicit confirmation that no tenant can query or see another tenant's data — this shouldn't be assumed from the application-layer isolation alone.
Area: Platform / Security
Proposal: Audit every table/store touched by the rental product for tenant-scoping, confirming every query is scoped by tenant at the data-access layer, not only in application logic.
Deliverables:
Acceptance criteria:
Boundaries:
Part of #4778.
Reconciliation decision (#5669, resolved 2026-07-15): #5218 and #5219 are already closed -- read their findings first, don't redo that discovery work. This issue is a narrower audit scoped to the rental product's own stores specifically (query-layer tenant-scoping for what Rent-a-Loop itself touches), building on what #5218/#5219 already found for AMS's broader global-singleton/telemetry surfaces. #4939 (tenant-scoping columns) remains this milestone's own deliverable and is already natively blocked-by this issue, #4793, and #4783.