Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.

ADR-0003 Row-Level Policies as Defence in Depth

Status: Proposed. The owner accepts by merging the PR that introduces it.

Context

Access is scoped by company and participant pair (Company-Isolation). The vault says database constraints and, if adopted, row policies are defence in depth (API-and-Request-Pipeline).

Decision

The application policy pipeline is the primary control. PostgreSQL row-level policies, keyed on company and participant, are added as a backstop where the Step 03 harness shows they are practical.

Consequences

A pipeline bug alone must not expose another company’s record. A policy backstop catches it, at some cost in complexity and query planning.

Revisit trigger

Revisit after the Step 03 harness: drop or narrow the policies if they block legitimate DG metadata views or cost too much.

Change history

Date	Change
2026-10-20	Created (bootstrap Phase 2)