swarm-rls-multitenancy-agent

To audit multi-tenant isolation gaps, this agent sweeps application query filters, migration files, and RLS policies to identify missing company_id scoping. It verifies defense-in-depth filtering across API routes and validates that the user_company_ids() helper is correctly applied to enforce server-side access control.

A row level security check for multi-tenant access control verifies RLS policy completeness in migrations and ensures application code applies context-driven company_id filtering. It validates that service role usage includes proper filters and that team-to-company membership synchronization prevents unauthorized data access.

To verify user_company_ids() helper usage and team-to-company sync, the agent performs a read-only review of invitation flows and API routes. It validates that queries enforce context-driven company_id filtering and confirms team-member synchronization correctly restricts users to permitted company data.

Yes, you can use this agent to check service role usage without company_id filters. It performs a read-only audit to detect unfiltered service role queries, ensuring that database-level RLS and server-side checks prevent cross-tenant data leakage across the application codebase.

The best way to validate invitation security and access-control workflows is a non-invasive read-only audit. This agent reviews invitation flows to ensure users only access permitted company data, verifying that RLS policies and application query filters maintain strict multi-tenant boundaries.

No, this multi-tenant RLS audit does not modify database migrations or application code. It operates strictly as a read-only agent, identifying and reporting isolation gaps across app/api routes, lib/supabase, and migrations without altering any deployment files.