Search docs

Docs search

Validation rule

Back to Rule Catalog

AP-DQR-001Data / Query Risk

Missing tenant filter evidence in multi-tenant SQL

Flags query paths where multi-tenant SQL lacks clear tenant-filter evidence.

warningviolationNo auto-fix

How to fix

Add an explicit tenant filter to the query.
Pass tenant context through repository/service boundaries.
Document intentional shared queries and add tests that prove tenant isolation.

What the rule validates

A query appears to touch tenant-scoped data without an obvious tenant filter.

Why it matters

Missing tenant filters can expose or mix data across tenants.

Common causes

Raw SQL omits tenant_id.
Tenant scoping is hidden behind an abstraction ArchPilot cannot identify.
A test fixture or report query was copied into production code.

Typical violation example

SELECT * FROM invoices WHERE status = 'open'

Typical compliant example

SELECT id, status FROM invoices WHERE tenant_id = $1 AND status = 'open'

Related rules

AP-DQR-002 - Broad SELECT * usage in query path AP-DQR-003 - Unbounded query risk without limit/pagination evidence AP-DQR-004 - Cross-module direct database access bypasses module boundary AP-DQR-005 - N+1 query evidence in collection loop

Adjacent categories

Data / Query Risk Findings & Exceptions

Related files/config

apps/api/src
db/sql
packages/db/prisma/schema.prisma

Related CLI commands

archpilot validate
archpilot validate --ci

Related docs

Rule Catalog Findings & Exceptions Validation & Findings

AP-DQR-001 - Missing tenant filter evidence in multi-tenant SQL | ArchPilot Docs