Tenancy & Organizations

Every surface under /app/[orgSlug] is strictly scoped.

The golden flow

Middleware does an optimistic cookie check.
getAppContext(orgSlug) in the layout resolves the org, member, and role or returns 404.
Feature queries use getOrgDb(ctx) + an explicit eq(....orgId, ctx.org.id) filter.
All mutations go through orgAction (zod schema → resolve context →assertCan → handler).

Cross-org access

Accessing another org’s data always returns 404 (never 403). This is intentional — it makes enumeration attacks useless and keeps error handling simple.

Per-tenant uniqueness

User-facing unique fields use composite UNIQUE(org_id, ...) constraints at the database level. The application catches the typed error instead of doing check-then-insert.

AEO ExplorerBeta

Tenancy & Organizations

Every surface under /app/[orgSlug] is strictly scoped.

The golden flow

Middleware does an optimistic cookie check.
getAppContext(orgSlug) in the layout resolves the org, member, and role or returns 404.
Feature queries use getOrgDb(ctx) + an explicit eq(....orgId, ctx.org.id) filter.
All mutations go through orgAction (zod schema → resolve context →assertCan → handler).

Cross-org access

Accessing another org’s data always returns 404 (never 403). This is intentional — it makes enumeration attacks useless and keeps error handling simple.

Per-tenant uniqueness

User-facing unique fields use composite UNIQUE(org_id, ...) constraints at the database level. The application catches the typed error instead of doing check-then-insert.