Workspace Isolation And Explicit Application Grants

Context

Job evidence contains references and input metadata belonging to one workspace.

Decision and Origin

Engine tables use forced workspace row security and workspace-scoped primary keys; upload and run reads enforce the same isolation, while rejection rows allow application insertion and reading. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

Alternative Comparison

Depend solely on application-side filters: A missing filter would otherwise expose another workspace’s records.

Consequences

Dispatch and purge transactions establish one workspace context.

Removing append-only evidence uses owner-authorized maintenance.

Actual grants permit receipt updates and queue or ledger deletion, contrary to some security commentary.