Skip to main content

Performance Tenant Isolation

Summary​

Global filters, child filtering, privileged context, and transition-tool exceptions.

Audience​

Backend engineers, database reviewers, architects, QA, support, operations, security reviewers, and product owners.

Overview​

Runtime business queries rely on context-level global filters. ReviewCycle, Appraisal, Goal, Review, Audit, and Timeline compare their tenant property with the current tenant unless privileged context is active.

Confirmed persistence behavior​

  • Child entities have their own tenant filters in addition to parent relationships.
  • Compatibility repositories use the same runtime filters.
  • Outbox and ProcessedIntegrationEvent have no tenant query filters.
  • The compatibility identity unique index is global, not tenant-prefixed.
  • Backfill and parity tooling deliberately bypass filters and add explicit tenant predicates where required.
  • Design-time context is privileged for model tooling and is not a normal request context.
  • Global filters are safeguards, not universal authorization assurance.

Classification​

Implemented tenant filtering with operational exceptions and Requires-confirmation governance.

Requires confirmation​

Privileged access, transition-tool controls, outbox/ledger tenant access, global uniqueness risk, and defense-in-depth testing require confirmation.

Diagram​

See Also​

Keywords​

  • Performance persistence
  • Tenant Isolation
  • Draft database documentation

Source References​

  • microservices/src/performance-service/Infrastructure/PerformanceDbContext.cs
  • microservices/src/performance-service/Infrastructure/Persistence.cs
  • microservices/src/performance-service/Backfill/PerformanceGoalBackfill.cs
  • microservices/src/performance-service/Backfill/PerformanceBackfillValidator.cs

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-16
  • Review cycle: Quarterly