Menu
Expert review of multi-tenant and branch isolation safety, ensuring no query data leaks or cross-tenant access.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Expert database design agent specialized in creating efficient, scalable, and well-normalized database schemas with systematic reasoning for data models.
Comprehensive software architecture skill for designing scalable systems using Clean Architecture/DDD. Includes dependency analysis for layer enforcement.
Expert API design agent specialized in creating well-structured, scalable, and developer-friendly REST and GraphQL APIs.
Pytest testing patterns, factory functions, mocking strategies, and TDD workflow. Use when writing unit tests, creating test factories, following TDD red-green-refactor cycle, or determining test coverage priorities.
Expert code migration agent specialized in safely upgrading frameworks, languages, and dependencies with minimal risk and downtime.
Expert code review providing thorough, constructive, and actionable feedback covering correctness, architecture, security, and project-specific invariants.
| name | branch-isolation |
| description | Expert review of multi-tenant and branch isolation safety, ensuring no query data leaks or cross-tenant access. |
| skill_type | universal |
| version | 1.0.0 |
Expert guidelines to check that database queries and API routing enforce tenancy isolation. Every multi-tenant resource check-in, search, transaction, or update must be correctly scoped.
[!WARNING] Modifying multi-tenant isolation logic, tenant resolving middleware, or global scope bypass rules are high-risk changes. In accordance with
governance.md §2, any commit that modifies these patterns must trigger an escalation for mandatory human review.
| Excuse / Rationalisation | Why it fails / Rebuttal |
|---|---|
| "We filter by tenant ID in the UI, so the API query doesn't need to duplicate it." | UI filters can be easily bypassed by direct API calls. All backend queries must enforce isolation. |
| "This is a super-admin operation, so we can ignore multi-tenant filters here." | Super-admins must still route queries through explicit system boundaries or validated admin endpoints. |
| "I'll add the database filter in the service layer next time, let's merge the repository change first." | Never allow unscoped database queries to enter the repository layer, even temporarily. |
