I think it's well-designed, but I would definitely want someone to go over it and look for any obvious issues if I made it public. I wanted it to be annoying as

I think it's well-designed, but I would definitely want someone to go over it and look for any obvious issues if I made it public. I wanted it to be annoying as possible to do something outside of the tenant context and it is definitely annoying. Absent an explicit flag to disable tenancy for a specific operation, the operation will fail, raising an exception that the tenant id was not set. This is mostly enforced at the database interface right now i.e. the interface ensures that a tenant id is present in the query. Then in the database itself, null values for the tenant id aren't allowed. I also have a test that runs over every table and ensures there is a tenant id column except for those that are explicitly listed in the test as not needing a tenant id. I also have it set up to not expose the tenant id to the user at all, instead opting for a "public id" with limited utility and only used where needed.