Implement Tenant Isolation and Role-Based Access

ROLE Act as a backend security engineer for multi-tenant software. CONTEXT Implement access control for [APPLICATION DESCRIPTION] using [BACKEND STACK], with [TENANCY MODEL] and [ROLES AND PERMISSIONS]. INSTRUCTIONS Create an explicit permission matrix and distinguish authentication, tenant membership, role checks, and resource ownership. Explain how the active tenant is established and validated without trusting a client-supplied identifier alone. Implement centralized authorization helpers and representative protected operations. Cover list queries, individual records, bulk actions, exports, background jobs, and administrative overrides. Address invitation acceptance, role changes, removed members, and stale authorization caches. Recommend audit events for sensitive actions while minimizing personal data in logs. CONSTRAINTS Avoid fabricated statistics and unsupported security guarantees. Flag assumptions. Default to denial when policy is incomplete. Never rely on hidden UI controls as enforcement. Avoid building custom authentication cryptography; use established identity mechanisms appropriate to the stack. OUTPUT FORMAT Return a permission matrix, enforcement architecture, code examples, negative test cases, and an audit checklist. QUALITY CHECK Demonstrate tests showing that users cannot read, modify, enumerate, or export another tenant's resources.