Guide 07 · Defense in depth
Make authority narrow and evidence difficult to rewrite.
Organization RLS, permission middleware, protected columns, revocable sessions, and a per-tenant hash chain reinforce one another.
Verify the tenant boundary
Every operational table carries organization_id. Test valid IDs from a different tenant and confirm RLS returns no record.
Test role escalation
Try protected profile, assignment, approval, and organization fields through direct API requests. Database triggers must reject the change even when UI controls are bypassed.
Revoke a session
The revoke function deletes Supabase Auth sessions and timestamps the profile. Revolution Road compares verified JWT iat on every page and API request for immediate denial.
Verify the chain
Read events in sequence order, recompute SHA-256 hashes outside production, and compare the last result with audit_chain_heads.last_hash.
Monitor delivery
Review failed notification rows, Edge Function logs, and retry counts. Rotate the Cron and relay secrets if they may have been exposed.
Release gate
Exercise all four roles before production.
Run the automated role matrix and 50-user simulation, then repeat the invite, assignment, approval, cross-tenant, last-admin, and session-revocation checks against the connected Supabase project.