To turn this practical: A good security model makes the right thing happen by default, and makes doing the wrong thing hard. A secure data model should make th

To turn this practical: A good security model makes the right thing happen by default, and makes doing the wrong thing hard. A secure data model should make the tenant identifier necessary to successfully complete a query. Haven’t composite keys (including composite primary keys) been around since SQL86? A good application layer, likewise, enforces that a tenant identifier is set on every endpoint, with no additional code, just from creating the endpoint.