← Changelog
SecurityMay 12, 2026
Complete workspace RBAC + tenant isolation audit
Every workspace-scoped dashboard API route now uses requireWorkspaceRole() or requirePlatform(). The trust proxy validates membership before forwarding to Core API. A workspace_tenant_isolation_audit materialized view covers all 24 workspace-scoped tables and surfaces orphaned rows. Bulk gate approvals require workspaceId in the request body (not session-derived).