Recruitment Database Tenant Isolation

Summary

Sixteen persisted object types use tenant-aware global query filters; the processed-event and outbox stores do not.

Audience

Developers, QA and support engineers, data reviewers, implementation partners, solution architects, and security reviewers.

Overview

Global filters cover all Recruitment aggregate, child, audit, and timeline objects. A privileged role bypasses them. Public opening/token repositories and development seeding explicitly call IgnoreQueryFilters.

Processed-event and outbox objects have no global query filter. Their records can carry tenant/correlation evidence, but isolation is not enforced by the model filter. Several unique indexes are global rather than tenant-composite. Universal tenant isolation, database-level row security, and privileged-path governance are not proven.

Requires confirmation

Production migration governance, rollback ownership, reconciliation, retention, privacy, performance, query optimization, concurrency, and operational ownership require confirmation.

Source References

• microservices/src/recruitment-service/Infrastructure/RecruitmentDbContext.cs
• microservices/src/recruitment-service/Infrastructure/Persistence.cs
• microservices/src/recruitment-service/Infrastructure/DevelopmentSeeder.cs

Related Articles

• Recruitment database documentation
• Recruitment technical documentation

See Also

• Recruitment API documentation
• Recruitment module

Keywords

• Recruitment database
• Tenant Isolation

Revision Information

• Status: Draft
• Last reviewed: 2026-07-16
• Review cycle: Quarterly