# TENANT_MODELS

**Kind:** Constant

**Source:** [`atloria-monorepo/libs/database/src/lib/tenant-backstop.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/libs/database/src/lib/tenant-backstop.ts#L22)

Tenant backstop — a Prisma client extension that guards against the cross-tenant bug class where a
service reads or mutates a row by id under a request context but forgets to scope it to the
caller's organization (the `_user`-ignored bug found in the SG red-team).

IMPORTANT: this is DEFENSE-IN-DEPTH. The primary control is ResourceOrgGuard at the controller
edge. This runs at the data layer as a second line.

It ships in LOG-ONLY (detect) mode: it never alters a query, it only records the distinct
(model, operation) shapes that ran unscoped under an org context — mapping the remaining surface
in real traffic with zero risk of breaking a query. Enforcement is opt-in per deployment (a flag)
and, even then, is applied ONLY to filter operations where injecting `AND organizationId` is
always valid Prisma — never to a unique-key op (findUnique/update/delete by id), where injecting a
non-unique field would be rejected, and never blindly over an intentional cross-org query (e.g.
`OR: [{ isPublic }, { organizationId }]`), which is why enforcement stays conservative and off by
default.

## Definition

```ts
ReadonlySet<string>
```