Data / Query Risk

Review implemented validation rules for tenant-filter evidence, broad projection, unbounded reads, N+1 patterns, in-memory processing, and repeated query flows.

Why it matters

Data / Query Risk findings focus on database access patterns that affect tenant safety, data exposure, and operational scale.

Overview

Review implemented validation rules for tenant-filter evidence, broad projection, unbounded reads, N+1 patterns, in-memory processing, and repeated query flows.

Data / Query Risk findings focus on database access patterns that affect tenant safety, data exposure, and operational scale.

Why it matters

Cloud uses this guidance to help teams interpret local validation findings in organization context without turning the docs into implementation notes.

When this domain drifts, findings become harder to triage, ownership becomes less clear, and architecture review depends too much on individual memory.

Good architectural practices

Tenant-scoped and bounded database access.
Explicit projections instead of broad entity loading.
Batching and request flow design that avoid N+1 or repeated query patterns.

Common anti-patterns

Missing tenant filter evidence in multi-tenant SQL
Broad SELECT * usage in query path
Unbounded query risk without limit/pagination evidence
Cross-module direct database access bypasses module boundary
N+1 query evidence in collection loop
Large collection loaded then processed in memory
Missing projection/select for partial entity use
Repeated query pattern in one request flow

Relationship to other architecture areas

This domain usually overlaps with neighboring validation categories. Use the related pages below to understand the adjacent architecture concerns before changing policy, suppressing a finding, or accepting risk.

Implemented rules

These are the currently implemented rules in this category. Use this table for category-level orientation, then open the Rule Catalog when you need rule-specific examples and remediation guidance.

Rule ID	Rule title	Category	Severity	Short explanation	Example violation	Remediation guidance	Rule detail
AP-DQR-001	Missing tenant filter evidence in multi-tenant SQL	Data / Query Risk	warning	Flags query paths where multi-tenant SQL lacks clear tenant-filter evidence.	SELECT * FROM invoices WHERE status = 'open'	Add an explicit tenant filter to the query. Pass tenant context through repository/service boundaries. Document intentional shared queries and add tests that prove tenant isolation.	View rule page
AP-DQR-002	Broad SELECT * usage in query path	Data / Query Risk	warning	Flags broad SELECT * usage in paths where explicit projection is safer.	SELECT * FROM account_summary	Replace SELECT * with explicit columns. Keep sensitive columns out of read models unless required. Update tests or snapshots that assumed the broad result shape.	View rule page
AP-DQR-003	Unbounded query risk without limit/pagination evidence	Data / Query Risk	warning	Flags list/query paths without obvious limit or pagination controls.	findMany({ where: { organizationId } })	Add limit and pagination parameters. Set a maximum page size. For exports, move heavy reads to an explicit export workflow with operational safeguards.	View rule page
AP-DQR-004	Cross-module direct database access bypasses module boundary	Data / Query Risk	warning	Flags database access that reaches into another module's owned data boundary directly.	risk imports payments ledger tables directly for scoring.	Use the owning module's public API or service boundary. Add a supported read model or event feed. Document temporary migration exceptions and remove them after the migration window.	View rule page
AP-DQR-005	N+1 query evidence in collection loop	Data / Query Risk	warning	Flags collection workflows that appear to query inside a loop.	for each repository, query latest snapshot separately.	Batch-load related records. Use include/select or joins where appropriate. Add tests or traces for collection-size behavior.	View rule page
AP-DQR-006	Large collection loaded then processed in memory	Data / Query Risk	warning	Flags query flows that load broad collections and filter or aggregate them in memory.	findMany(...) loads all findings, then filters open findings in JavaScript.	Push filtering, projection, and aggregation into the query. Apply limits before loading records. Move large exports to explicit batch workflows.	View rule page
AP-DQR-007	Missing projection/select for partial entity use	Data / Query Risk	warning	Flags queries that load full entities when only a small subset of fields is used.	Load full user records to render only name and email.	Add select/projection for required fields. Keep sensitive fields out of read paths by default. Update response mapping tests after narrowing the shape.	View rule page
AP-DQR-008	Repeated query pattern in one request flow	Data / Query Risk	warning	Flags request flows that repeat the same or similar query multiple times.	A request loads organization membership in auth, service, and repository helpers separately.	Fetch shared context once and pass it through. Batch similar queries. Add request-level caching only when it matches consistency needs.	View rule page

Tenant Isolation API Design Rule Catalog

Next steps

Event Architecture Upload Troubleshooting