ADR 0002: Multi-Tenancy

Status

Accepted

Context

Users connect brokers, portfolios, risk settings, journal entries, and LLM provider keys. Tenant isolation must be enforced consistently across API, workers, journal views, and generated reports.

Decision

Use user_id and portfolio_id as the tenant scoping keys across domain tables. API routes derive identity from Better Auth JWTs. Database access keeps tenant context explicit in queries and tests cover RLS-protected paths where available.

Consequences

Filtered views such as strategy history, portfolio recent trades, agent reflections, and Journal detail screens all use the same canonical trade/audit records. This avoids duplicate stores and reduces reconciliation risk.

Verification

Every authenticated route must derive the user from auth context, and tests must cover cross-user access denial for sensitive resources.