Skip to content

docs(objectql): Multi-Tenant Schemas says the injected organization_id is stamped on insert and NOT NULL on a table the driver creates #25322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
objectstack-fleet merged 1 commit into from
Oct 23, 2026
Merged

docs(objectql): Multi-Tenant Schemas says the injected organization_id is stamped on insert and NOT NULL on a table the driver creates #25322

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions content/docs/protocol/objectql/schema.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,9 +719,9 @@ full_name:

Row-level isolation runs on **one platform column**: `organization_id`, a lookup to
`sys_organization`. The registry injects it into every registered object that has not
opted out (`hidden`, `readonly`, `required: false` — it is server-populated on insert
and stays NULL where no organization context exists), so a tenant-scoped object
declares **nothing** about tenancy:
opted out (`hidden`, `readonly`, `required: false` — the platform stamps it on
insert, so the author never writes it), so a tenant-scoped object declares **nothing**
about tenancy:

```yaml
name: customer
Expand All @@ -731,6 +731,22 @@ fields:
required: true
```

`required: false` describes the authoring surface, not the stored value: NULL is not an
organization (ADR-0131 D1). An insert is stamped with the writer's organization — under
the `single` posture, with the Default Organization — and a write that names none is
refused wherever an organization can exist (ADR-0131 D9). A table the SQL or Turso
driver creates carries the column `NOT NULL` at `CREATE TABLE`, so the database itself
refuses a row with no organization, an `upsert` included (ADR-0131 D1; changeset
`tenant-column-not-null-ddl` of `@objectstack/driver-sql` and `@objectstack/driver-turso`).
The in-memory driver enforces no `NOT NULL`. A table that already existed — created by an
earlier release, or one the driver adds the column to — keeps a nullable column until
[`os migrate organization-ownership`](/docs/deployment/cli#os-migrate-organization-ownership)
tightens it, and that ceremony cannot tighten a rotated shard or a table on the Turso
remote face; [`os migrate plan`](/docs/deployment/cli#tenant-columns-still-nullable-advisory)
lists every tenant column still nullable, with the reason. An object whose rows belong
to no organization does not leave the column empty — it opts out, and has no column at
all.

The column's existence does not depend on the deployment's tenancy posture — only its
*index* does, since nothing filters by organization on a single-organization stack. An
object opts **out** by declaring `tenancy.enabled: false`
Expand Down
Loading