Edu-Carone-SA puts tenant walls around Mike's client data

For a legal-AI product handling client documents, tenant isolation cannot rest on the application behaving perfectly. Edu-Carone-SA has added access rules across the product's database, backed by a defined tenancy model and tests that try to cross the line between users and organisations.

The work covers the whole data store, with 82 access policies across 25 tables, plus checks for which routes require which level of protection. There is also a verification step and a rollback path, which matters when security controls need to be audited or reversed safely.

The fork's production release remained blocked by a separate AGPL licensing question. That does not change the value of this security work, but it does mean prospective adopters should assess the licensing position too.