skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

tenant-aware-query-design

Ensure tenant-scoped queries include a tenant_id filter across SQL and ORM layers.

Updated Mar 29, 2026
Search Tags:#security#multi-tenant#sql#orm#data-isolation#tenant-filtering
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-aware-query-design
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tenant-aware-query-design
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/tenant-aware-query-design
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-aware-query-design

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Ensure all queries against tenant-scoped tables include a tenant_id filter to prevent cross-tenant data access.

Core Features & Use Cases

  • Enforced core rule: Every SELECT, UPDATE, and DELETE on tenant-scoped tables must include a WHERE tenant_id = ?
  • ORM/global scope: Apply tenant filters at the repository/ORM level so developers cannot forget
  • Audit & tests: Provide automated checks and tests to verify tenant isolation in PRs and CI
  • Migration guidance: Strategies to retrofit existing code to enforce tenant scope

Quick Start

Audit your repository to apply a global tenant filter to all queries on tenant-scoped tables.

Frequently Asked Questions about tenant-aware-query-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce tenant isolation and prevent cross-tenant data access in SQL queries?▼

Tenant isolation is enforced by ensuring every SELECT, UPDATE, and DELETE on tenant-scoped tables includes a WHERE tenant_id filter. This prevents cross-tenant data access by restricting operations to a specific tenant boundary.

How do I apply global tenant filtering at the ORM or repository layer?▼

You apply global tenant filtering at the repository or ORM level using global scopes. This ensures developers cannot forget to include tenant_id filters in their queries, automatically enforcing data isolation across the application.

How do I automate tenant isolation checks in CI for multi-tenant SaaS?▼

You automate tenant isolation checks by integrating automated tests and reviews into your CI pipeline. This verifies that all queries against tenant-scoped tables maintain structural tenant filtering before code is merged.

What is the best way to retrofit existing repository code to enforce tenant scope?▼

The best way to retrofit existing code is to follow migration guidance strategies that apply global tenant filters to current queries. This updates legacy repository layers to enforce tenant scope without missing unprotected operations.

Do I need raw SQL tenant filtering if I already use ORM global scopes?▼

Yes, raw SQL tenant filtering is necessary because ORM global scopes do not protect direct database queries. Structural tenant filtering must be applied across both ORM-driven queries and raw SQL to guarantee complete data isolation.

Can I use tenant-aware query design for multi-tenant SaaS database migrations?▼

Yes, tenant-aware query design supports multi-tenant SaaS environments by providing migration guidance. It helps retrofit existing code to enforce tenant scope, ensuring all tenant-scoped tables maintain proper data isolation during transitions.

Related Skills

Explore More Software Engineering Skills→
navraj007innavraj007in
2

generate-data-model

Convert architecture blueprint database schemas into Prisma, Drizzle, or TypeORM models, migrations, and seed data.

Community
Advanced
marquesfelipmarquesfelip

single-database-tenant-isolation

Enforce tenant_id scoping across tenant-related tables in single-database SaaS applications.

Community
Advanced
linenoizelinenoize
1

db

Generate rollback-aware database migration files and validate schema changes.

Community
Advanced
raphaelmansuyraphaelmansuy
2

multi-tenant-postgres

Implement multi-tenant PostgreSQL isolation with row-level security.

Community
Advanced