No cross-tenant data visible in API responses

CWE-285 (Improper Authorization) and OWASP A01 describe exactly this failure: an API that returns records without verifying the requester owns them. For list endpoints, a missing tenant filter exposes every record in the table to every authenticated user. For single-resource endpoints, guessing or enumerating a UUID is enough to retrieve another tenant's document, project, or user record — no special privilege required. This constitutes unauthorized disclosure of confidential business data and, where PII is involved, a reportable data breach under GDPR Art. 33.

For single-resource lookups, always fetch by both id and organizationId together so the database enforces ownership at query time rather than after the fact:

// Instead of:
const doc = await db.documents.findUnique({ where: { id: params.id } })

// Do this:
const doc = await db.documents.findUnique({
  where: { id: params.id, organizationId: session.user.organizationId }
})
if (!doc) return new Response('Not found', { status: 404 })

For list endpoints, verify the underlying database query already has tenant scope applied (see every-query-tenant-scoped) — never filter in application memory after a broad fetch. Return 404 (not 403) on ownership mismatch to avoid confirming that the resource exists.