---
id: ADR-PFM-DJE-017
title: Workspace isolation and explicit application grants
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Engine tables use forced workspace row security and workspace-scoped primary
  keys; upload and run reads enforce the same isolation, while rejection rows
  allow application insertion and reading.
constrains:
  - DOM-PFM-DJE-001
  - DOM-PFM-DJE-003
  - DOM-PFM-DJE-004
  - DOM-PFM-DJE-005
  - SVC-PFM-DJE-engine
origin: >-
  services-platform:docs/proposals/rhythm-data-job-engine-plan.md §16 security
  (approved 2026-10-12); services-platform:docs/row-level-security.md
alternatives:
  - option: Depend solely on application-side filters
    why_not: A missing filter would otherwise expose another workspace’s records.
consequences:
  - Dispatch and purge transactions establish one workspace context.
  - Removing append-only evidence uses owner-authorized maintenance.
  - >-
    Actual grants permit receipt updates and queue or ledger deletion, contrary
    to some security commentary.
supersedes: []
evidence:
  - 'macroservice-libraries at 54536a44: src/row-level-security.ts'
  - >-
    services-platform at ad3f6a65:
    services/maintenance/data-operations-participant.ts
---

# Workspace Isolation And Explicit Application Grants

## Context

Job evidence contains references and input metadata belonging to one workspace.

## Decision and Origin

Engine tables use forced workspace row security and workspace-scoped primary keys; upload and run reads enforce the same isolation, while rejection rows allow application insertion and reading. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Depend solely on application-side filters: A missing filter would otherwise expose another workspace’s records.

## Consequences

Dispatch and purge transactions establish one workspace context.

Removing append-only evidence uses owner-authorized maintenance.

Actual grants permit receipt updates and queue or ledger deletion, contrary to some security commentary.