Access & multi-tenancy
How isolation and row-level security protect your data.
TraceGuard is multi-tenant, and isolation is a core guarantee — not a configuration option you can accidentally turn off.
Organization isolation
Every org-scoped record carries its organization boundary, and that boundary is enforced in the database via row-level security (RLS). A query can only ever return rows the caller's organization is entitled to — so even a bug in application code can't leak another tenant's data.
Shared vs. per-org data
Some records are global and shared (for example, public vulnerability data and component identities). These hold no organization-specific state — your decisions, VEX, overrides, and findings live in org-scoped tables, never on shared rows.
Principals & effective access
A principal is anything that acts: a member, a service account, or a token. Effective access is computed from the principal's roles and permissions, intersected with the authority of whoever granted them. The app exposes an access inspector so you can see exactly what a given principal can do, and why.
The same boundaries apply to the API and the MCP server: a token can never read or change anything its owner couldn't.