Employee Database Tenant Isolation

Summary

Employee domain and organization rows persist a tenant identifier. EF Core global query filters restrict normal queries to the current tenant, while selected uniqueness checks deliberately bypass filters and reapply an explicit tenant predicate.

Audience

• Backend and QA engineers
• Security engineers and solution architects

Isolation flow

Filter inventory

Object group	Tenant field	Global filter	Source
Employees	Integer	Current tenant or super-admin	Infrastructure/EmployeeDbContext.cs
Eight Employee child objects	Integer	Current tenant or super-admin	same
Departments and Designations	Integer	Current tenant or super-admin	same
Employee audit logs	Integer	Current tenant or super-admin	same
Outbox messages	Shared optional tenant concept	No end-user global filter; operational store	same

When no tenant is present, the context filter compares normal tenant-scoped objects with a non-business sentinel value; command/query handlers separately call RequireTenantId for approved direct operations. Compatibility paths do not apply that requirement uniformly, so their missing-context behavior remains Requires confirmation.

Scoped constraints and repositories

• Employee code, department code, and designation code are database-unique within tenant scope.
• Employee email uniqueness is checked in application/repository code within the tenant, but no unique email database index exists.
• Child tenant identifiers are stamped from the aggregate rather than accepted independently.
• Uniqueness repositories use IgnoreQueryFilters only with an explicit tenant condition.

Super-admin boundary

The query filters contain a confirmed super-admin bypass. Which public operations may invoke it and how access is governed are outside this database model and Requires confirmation. Its existence is not a complete security assurance; authorization, deployment, and database privileges remain separate controls.

Source References

• microservices/src/employee-service/Infrastructure/EmployeeDbContext.cs
• microservices/src/employee-service/Infrastructure/Persistence.cs
• microservices/src/employee-service/Application/Common/Abstractions.cs
• microservices/src/employee-service/Application/Validators/EmployeeCommandValidators.cs

Related Articles

• Security boundaries
• Authentication and context
• Multi-tenancy architecture

See Also

• Database testing guide
• Schema reference

Keywords

• Global query filter
• Tenant-scoped uniqueness
• Super-admin context

Revision Information

• Status: Draft
• Last reviewed: 2026-07-15
• Review cycle: Quarterly