Tenant isolation before features

Every CRM feature is a liability if workspace_id filters are optional. MSH OS treats tenant scope as a platform capability, not a per-route afterthought.

Authorization runs after auth and before handlers. Search, files, billing webhooks, and notifications each re-assert workspace context. Tests should prove cross-tenant denial, not just happy paths.

If you are building a multi-tenant product on a founder domain, resist the urge to expose admin shortcuts on the same routes as customer data. Platform admin gets its own surface with stricter gates.