ADR-008 draft-3: corrections, plane R, and a name

Browse source

Renamed to Tenancy Posture. Four Planes stopped being true and a name that
encodes a count breaks every time the framework grows; the posture vector is
the durable centre.

Corrections from the research digests:

- E3 no longer claims the application cannot route around it. Any session can
  re-SET the GUC, so E3 is decisive against a forgotten predicate and useless
  against SQL injection or a compromised process. Replaced the claim with a
  threat-model table. Draft-2 was overclaiming in exactly the way section 6
  prohibits, which is the correction I most wanted made before review.
- E3 layers on E2 rather than replacing it; claiming E3 now requires the E2
  artifact too, because E3 alone fails open under injection.
- The GUC is set transaction-locally, not at pool checkout, and the scaling
  section's pooling claim was backwards: SET LOCAL is what makes E3 safe under
  a pooler; statement-level pooling is what leaks.
- Placement is a default plus per-tenant exceptions. One P level per service
  could not express the isolation tiers section 11 already sells.

Added plane R for retention and erasure, implementing the rapp-postgres
ADR-0002 interface: N-day retention defaulting to 30, a published erasure
horizon, and dataset sweeps whose policy the consumer owns. R exists because
deleting a row does not remove it from yesterday's backup, and the estate had
never written that down.

Also: A4 for a standard PDP interface now that AuthZEN is Final; evidence split
into mechanical and adversarial, since a green CI run is not E2 evidence; the
tenant boundary named as OWASP API1; and section 14 recording the
structure-not-tooling stance.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

...

This commit is contained in:

codex 2026-08-17 14:33:50 +02:00

parent f09d3ef5d2

commit d0b57b1a50

1 changed files with 460 additions and 356 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

816

canon/architecture/adr-008-multi-tenancy-model.md

View file

File diff suppressed because it is too large Load diff