carmanagement/docs/ADR-002-defer-postgres-rls.md

ADR-002 — Defer Postgres RLS until app-level isolation is proven

Status

Accepted (Phase 3) — RLS not enabled yet

Context

Phase 3 lists optional Postgres row-level security after app-level cross-tenant tests. The API already scopes queries with companyId from the authenticated session. Enabling RLS without a complete policy matrix and migration path risks breaking admin, workers, migrations, and reporting jobs that use elevated DB roles.

Decision

1. Land and keep expanding the app-level suite (apps/api/src/tests/integration/cross-tenant-isolation.test.ts).
2. Do not enable FORCE ROW LEVEL SECURITY in production until:
   • Cross-tenant suite covers vehicles, customers, reservations, payments, team, billing reads
   • Worker and migration DB roles are designed (BYPASSRLS or dedicated policies)
   • A staging soak proves no latent findMany without tenant predicates
3. Revisit RLS as a defense-in-depth layer in a dedicated change set — not as a gate to start Phase 3 assurance work.

Consequences

• Tenant safety remains an application responsibility in the near term.
• Pen-testers should still treat missing companyId filters as Critical.
• Future RLS work tracks under Phase 3 optional / post-GA hardening.