Tenant isolation
Every record belongs to one organization, enforced at the model layer rather than in each query. 20 models carry the tenant scope, so a missing WHERE clause cannot leak another company's data.
- Scoping is declared on the model, not repeated per query
- Each entity under a holding company keeps its own departments, budgets and approval chains