Scope all mutations to the authenticated organization | BeforeMerge Rules | BeforeMerge

Scope all mutations to the authenticated organization | BeforeMerge Rules | BeforeMerge

Why This Matters

RLS is your safety net, but application-level scoping is your primary defense.

Good

export async function createRule(data: FormData) {
  const { orgId } = await requireAuth()
  await admin.from("rules").insert({
    ...data,
    organization_id: orgId,  // Always scope to org
  })
}

Bad

export async function createRule(data: FormData) {
  await admin.from("rules").insert(data)
  // Missing org_id — relies entirely on RLS
}