Harden private-by-default RLS and org share for first production.

↗ view on GitHub · Clava Orchestrator · 2026-07-23 · 9f52a8e8

Apply owner-or-sharee SELECT policies, storage deny for authenticated, match_chunks project access, and org-member picker/API so tenant content stays private unless explicitly shared.
Repository bgevconsultancy/Helm-v2
Author Clava Orchestrator <orchestrator@clava.local>
Authored
Parents 5fd31507
Stats 41 files changed , +4205 , -340
Part of Org-scoped multi-tenancy: schema, RLS, route enforcement, and isolation testing

Capture this commit into my fork

Download a Markdown prompt that tells Claude how to port this exact commit into your working tree. Run it via claude -p < capture-commit-9f52a8e8.md from inside the repo you want the change in.

⬇ Download capture-commit-9f52a8e8.md