A tenant claim is not tenant isolation

A JWT or session that carries tenant_id proves which tenant the caller claims to belong to. It does not isolate data by itself.

If your queries only filter by an ID the client sent — or trust the claim without re-binding it to the authenticated subject — one forged or swapped tenant value can leak another org's records.

Pattern that holds up:

1. Authenticate the subject.
2. Resolve the subject's allowed tenants from your source of truth (not from an untrusted body field).
3. Scope every read and write with that tenant bound, and authorize subject + action + resource inside it.

Multi-tenant security is an authorization check on every query, not a claim in a token.