Boundaries must be visible
Users do not read schemas. They need to know which venue or club they are in, and whether an action can leak across workspaces. Copy, breadcrumbs, empty states and permission errors are part of the boundary.
Three layers, one story
- Product: workspace, role, invite, audit log.
- Service: validation and policy before state changes.
- Data: RLS or equivalent checks close to the record.
Audit is not an afterthought
When money, lineups or orders change, someone must own the confirmation. Audit supports recovery and explanation — especially once AI starts proposing changes.
Fast but wrong-tenant is not speed. It is operational debt.