One provider, two rivals, and the wall between them
A bid-writing consultancy works for firms that compete with each other. Tenant isolation cannot help: both customers’ evidence sits inside one tenancy, so the wall has to be somewhere else.
CONSTRUX Bid-On is for bid work delivered for somebody else. A consultancy writes submissions for several contractors, and sooner or later two of its customers chase the same framework. Both have handed over their accident statistics, their insurance values, their case studies and their people’s CVs.
The usual answer to keeping customer data apart is tenant isolation, and here it is no answer at all. Both firms’ material sits inside one tenancy — the provider’s. If an evidence item hung off the tenant, the retriever would be one missing filter away from citing one electrical contractor’s accident rate in a competitor’s submission to the same buyer. There is no apology for that, and no way to explain it afterwards.
So customerAccountId is on the record — the same golden thread every other module in the platform appends to — and not on a query somebody remembers to write. The retriever takes the customer as an argument it cannot ignore, and it filters before it ranks — not after, and not in the caller. Embedding everything and filtering the results afterwards would mean another customer’s prose had already been sent to a provider before anybody decided the reader could not see it.
Access is per customer and restrictive by default. A new workspace is visible to whoever opened it and to the staff assigned to it, and to nobody else. The opposite default — everybody sees everything unless excluded — is one forgotten exclusion away from a competitor’s evidence on the wrong screen, and nothing about that failure is visible until it matters.
Because access is partial, the register says what it is not showing. “You are seeing four of nine” is a true and useful statement; four rows that look like all of them is not. The same sentence appears wherever the view is narrowed, including on the list of tenders already imported, where a bid reference and a buyer name together would be enough to work out that a rival is bidding the same job.
The wall is then enforced at every door rather than at one. A citation is refused unless it points at this customer’s own evidence. Retrieval refuses a customer this person is not assigned to. A returnable can only cite this customer’s own filed item. Carry-forward offers prior answers only from the same company’s own earlier submissions, however well another firm’s answer happens to match.
That is the whole product claim, and it is a structural one rather than a promise: the separation is in the shape of the record, so there is no code path where forgetting a filter is possible.
See the record being made rather than described.
Launch the demo environment