Tenant isolation a user cannot bypass
Isolation that depends on developers remembering is policy. Isolation the data layer enforces is architecture. How we build multi-tenant systems where the unsafe direction requires intent, and where tests police the tables that do not exist yet.
August 30, 2026 · Engineering
What a CAIQ questionnaire really wants
A CAIQ is not an exam to ace. It is a test of whether you can describe your own system truthfully. What we learned filing two CSA STAR self-assessments as a small vendor, including why seven of our answers are No, on purpose.
August 30, 2026 · Trust