1
🌐
Incoming Request
Subdomain / Custom Domain / Auth Header
2
🛡️
Edge Middleware
Fail-closed resolution (404/403 on error)
3
📦
Tenant Context
Verified tenant_id & role in JWT claims
4
⚡
App Router
React 19 RSC & Server Actions
5
🔒
Postgres RLS
Hard DB boundary via auth.jwt()
6
✅
Isolated Data
Zero cross-tenant contamination