tenant-safe-delivery

name	tenant-safe-delivery
description	Implement or review backend, model, database, and API work that touches tenant-owned data in this repository. Use when changing salons, branches, staff, clients, bookings, reviews, payments, or roles.

Tenant Safe Delivery

This skill exists to prevent cross-tenant leakage and role confusion.

Questions to answer before coding

1. Which model owns this data?
2. Is this record global, tenant-owned, or branch-owned?
3. Which actor can read it?
4. Which actor can mutate it?
5. What test will prove another tenant cannot access it?

Delivery rules

• scope queries intentionally
• use policies and role checks
• validate tenant ownership before mutation
• prefer explicit services for cross-model workflows
• write regression tests for forbidden access

Minimum tests

Add at least one negative-path test when the task touches:

• bookings
• clients
• staff
• payments
• tenant settings
• admin-only actions