# ADR-002 — Defer Postgres RLS until app-level isolation is proven

## Status

Accepted (Phase 3) — **RLS not enabled yet**

## Context

Phase 3 lists optional Postgres row-level security after app-level cross-tenant tests. The API already scopes queries with `companyId` from the authenticated session. Enabling RLS without a complete policy matrix and migration path risks breaking admin, workers, migrations, and reporting jobs that use elevated DB roles.

## Decision

1. Land and keep expanding the app-level suite (`apps/api/src/tests/integration/cross-tenant-isolation.test.ts`).
2. Do **not** enable `FORCE ROW LEVEL SECURITY` in production until:
   - Cross-tenant suite covers vehicles, customers, reservations, payments, team, billing reads
   - Worker and migration DB roles are designed (`BYPASSRLS` or dedicated policies)
   - A staging soak proves no latent `findMany` without tenant predicates
3. Revisit RLS as a defense-in-depth layer in a dedicated change set — not as a gate to start Phase 3 assurance work.

## Consequences

- Tenant safety remains an application responsibility in the near term.
- Pen-testers should still treat missing `companyId` filters as Critical.
- Future RLS work tracks under Phase 3 optional / post-GA hardening.