tenant-aware-query-design

Ensure tenant-scoped queries include a tenant_id filter across SQL and ORM layers.

Updated Mar 29, 2026

Search Tags:#security #multi-tenant #sql #orm #data-isolation #tenant-filtering

Ready to run

npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-aware-query-design

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tenant-aware-query-design
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/tenant-aware-query-design
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-aware-query-design

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Ensure all queries against tenant-scoped tables include a tenant_id filter to prevent cross-tenant data access.

Core Features & Use Cases

Enforced core rule: Every SELECT, UPDATE, and DELETE on tenant-scoped tables must include a WHERE tenant_id = ?
ORM/global scope: Apply tenant filters at the repository/ORM level so developers cannot forget
Audit & tests: Provide automated checks and tests to verify tenant isolation in PRs and CI
Migration guidance: Strategies to retrofit existing code to enforce tenant scope

Quick Start

Audit your repository to apply a global tenant filter to all queries on tenant-scoped tables.

Frequently Asked Questions about tenant-aware-query-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce tenant isolation and prevent cross-tenant data access in SQL queries?▼

Tenant isolation is enforced by ensuring every SELECT, UPDATE, and DELETE on tenant-scoped tables includes a WHERE tenant_id filter. This prevents cross-tenant data access by restricting operations to a specific tenant boundary.

How do I apply global tenant filtering at the ORM or repository layer?▼

You apply global tenant filtering at the repository or ORM level using global scopes. This ensures developers cannot forget to include tenant_id filters in their queries, automatically enforcing data isolation across the application.

How do I automate tenant isolation checks in CI for multi-tenant SaaS?▼

You automate tenant isolation checks by integrating automated tests and reviews into your CI pipeline. This verifies that all queries against tenant-scoped tables maintain structural tenant filtering before code is merged.

What is the best way to retrofit existing repository code to enforce tenant scope?▼

The best way to retrofit existing code is to follow migration guidance strategies that apply global tenant filters to current queries. This updates legacy repository layers to enforce tenant scope without missing unprotected operations.

Do I need raw SQL tenant filtering if I already use ORM global scopes?▼

Yes, raw SQL tenant filtering is necessary because ORM global scopes do not protect direct database queries. Structural tenant filtering must be applied across both ORM-driven queries and raw SQL to guarantee complete data isolation.

Can I use tenant-aware query design for multi-tenant SaaS database migrations?▼

Yes, tenant-aware query design supports multi-tenant SaaS environments by providing migration guidance. It helps retrofit existing code to enforce tenant scope, ensuring all tenant-scoped tables maintain proper data isolation during transitions.