bc4318ef97
- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism. - Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions. - Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests. - Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.
22 lines
604 B
Markdown
22 lines
604 B
Markdown
# Row-level security
|
|
|
|
Purpose
|
|
- Enforce tenant isolation at the database level with RLS policies.
|
|
|
|
Strategy
|
|
- Apply RLS to tenant-scoped tables and views.
|
|
- Require app.tenant_id session setting on every connection.
|
|
- Deny access when tenant context is missing.
|
|
|
|
Policy evaluation
|
|
- Policies filter rows by tenant_id and optional scope.
|
|
- Admin bypass uses explicit roles with audited access.
|
|
|
|
Validation
|
|
- Run cross-tenant read and write tests in staging.
|
|
- Include RLS checks in deterministic replay suites.
|
|
|
|
Related references
|
|
- data/postgresql-patterns.md
|
|
- docs/operations/rls-and-data-isolation.md
|