ADR-0106: Platform, tenant, project, environment tenancy with forced RLS

• Status: accepted
• Date: 2026-10-30
• French version: ../ADR-0106-tenancy-rls.md

Context

The kit (section 6.2) requires tenant RLS and FORCE ROW LEVEL SECURITY.

Decision

The tenant comes from the access credential, never from the request body. Every tenant table enables RLS, a policy on eai.current_tenant() and eai.is_platform(), and forced RLS; transactions go through db.tx(principal).

Consequences

A tenant table without forced RLS fails the tests.

Evidence

• sql/postgres/V002__tenants.sql
• sql/postgres/V003__projects_environments.sql
• sql/postgres/V100__force_row_level_security.sql
• services/control-plane/tests/test_core_rls_forced.py
• RULES.md (section 3, point 2)