Your data is yours

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Give the first journey's records an owner and scope every query to it, then prove one user cannot reach another's data.

Usually comes after: Sign-in flow.

Leads to: Product analytics, Authorization & least privilege.

Prompt for your AI assistant

Read docs/product/mvp.md, the data access layer and the expand and contract rule in docs/ if there is one. Give every user-owned record in the first journey an owner: add the field as an additive change, assign the existing records to a user I name or delete them if I say so and make the field required in a later release. Put the check in the data access layer, so a query cannot run without the current user. Answer 404 rather than 403 for another user's record, so ids reveal nothing. Add a test per endpoint where user B asks for user A's record and list in docs/ anything that is shared on purpose.

This is https://gradus.kazet.blog/tree/cloud-application/step/data-ownership as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.