Guardrails: Keeping customer data separate in a multi tenant system
summary
Sets a per-request safe app thread-local and enforces it: an ActiveRecord init callback emits metrics then raises if model.app_id disagrees, cutting mis-scoped instantiations from about 12 billion/hour down to near zero; cache writes use MemCacheStore entry marshalling to embed and validate safe_app_id so cross-tenant cache reads raise exceptions; rollout takes hundreds of small PRs but cache changes ship in days, and payoffs include Honeycomb per-customer traces, automatic shard routing, and a per-customer kill switch.
AI-written summary · about
