Skip to main content

Workflow Database Tenant Isolation

Summary​

Canonical aggregates, their children, audit and timeline use EF Core global query filters based on ambient numeric tenant context.

Isolation diagram​

Filtered entities​

Nine entity types have filters: definitions, versions, steps, conditions, instances, tasks, actions, audit and timeline.

Context behavior​

Missing runtime tenant becomes the context’s zero fallback for filtered reads. Mutation commands separately require a positive tenant. A recognized administrative role bypasses filters. Design-time/seeding context also bypasses them.

Filter gaps​

Outbox and processed-event entities have no tenant query filter. Their tenant representations also differ from canonical numeric tenant fields.

Requires Confirmation​

Trusted tenant injection, administrative governance, unfiltered operational access and cross-tenant write safeguards require confirmation.

Source References​

  • microservices/src/workflow-service/Infrastructure/WorkflowDbContext.cs
  • microservices/src/workflow-service/Infrastructure/Persistence.cs
  • microservices/src/workflow-service/Application/Common/Abstractions.cs

See Also​

Keywords​

Workflow database, EF Core, Workflow schema.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20