Workspace row policies with explicit global vocabularies

Context

Customer accounting configuration must remain isolated. Shared currency, purpose and processor vocabularies intentionally serve all workspaces.

Decision

Customer-owned Books and maintenance tables use workspace-scoped keys and forced row-level security. Global vocabularies are exceptions; schedule claiming uses narrow cross-workspace policies within its transaction.

Alternatives Considered

Rely only on service filters. A missing filter could expose another customer’s records without database protection.

Give the dispatcher a general row-security bypass. That proposed privilege is broader than the narrow claim transaction requires.

Consequences

Ordinary reads treat another workspace’s records as absent, and scoped references reject cross-workspace destinations.

The scoped purge tests check that another workspace’s records survive erasure.