Tenant isolation

How one organization's data is kept from every other organization.

One organization, one boundary

Every facility organization and every provider organization is a tenant. Its rows carry its organization, and each read and write is made for the signed-in person's own organization (docs/decisions/0025-platform-admin-through-a-platform-organization.md).

Even HealthyRides' own staff work through an organization of their own, which owns no rides, patients or providers, so the same organization filter applies to them (docs/decisions/0025-platform-admin-through-a-platform-organization.md).

Asking for another organization's record

When a request names a record in its address, the app looks it up with the caller's organization in the query itself. A record that belongs to another organization is answered exactly like one that does not exist, so a request cannot reveal whether it is there (docs/decisions/0014-403-for-a-body-id-404-for-a-path-id.md).

When a request names a record in its body, for example the facility or patient a new ride is for, the app checks that the record is the caller's organization's before it writes anything, and refuses the request otherwise. A refused request writes no row and no audit row (docs/decisions/0014-403-for-a-body-id-404-for-a-path-id.md; platform/packages/domain/src/shared/tenant-fk.ts).

A person's account can belong to more than one organization, so the app reads a person only through their membership in the reader's own organization, never by account alone (docs/decisions/0010-workos-is-the-system-of-record-for-identity.md).

What a transport provider sees

A provider sees a patient's information only through rides it has won or is bidding on. While it bids it sees what the transport needs (requirements, constraints and the payer class), and the patient's full details, diagnosis list and payer open only to the winning provider once the ride is scheduled (docs/prd/healthyrides-mvp-prd.md). A losing bidder sees none of them (docs/prd/healthyrides-mvp-prd.md).

Inside one facility organization

Staff of a facility organization read the organization's rides at every one of its locations, within what their role allows. Assigning a person to locations limits where they may book, not what they may read (docs/decisions/0019-location-assignments-limit-booking-not-reading.md).

Demonstration and test data

Sales demonstrations and product tests run in organizations flagged as demonstration organizations, filled with invented data and kept in a partition apart from real organizations (docs/decisions/0040-demo-organizations-are-a-flag-and-a-partition.md). Test workspaces cannot be created or reached in production at all (docs/decisions/0051-a-test-workspace-is-a-demo-workspace-with-a-purpose-and-404s-in-production.md).