# Your data is yours

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/data-ownership

Give the first journey's records an owner and scope every query to it, then prove one user cannot reach another's data.

Usually comes after: [Sign-in flow](https://gradus.kazet.blog/tree/cloud-application/step/sign-in-flow).

Leads to: [Product analytics](https://gradus.kazet.blog/tree/cloud-application/step/product-analytics), [Authorization & least privilege](https://gradus.kazet.blog/tree/cloud-application/step/authorization).

## Prompt for your AI assistant

```
Read docs/product/mvp.md, the data access layer and the expand and contract rule in docs/ if there is one. Give every user-owned record in the first journey an owner: add the field as an additive change, assign the existing records to a user I name or delete them if I say so and make the field required in a later release. Put the check in the data access layer, so a query cannot run without the current user. Answer 404 rather than 403 for another user's record, so ids reveal nothing. Add a test per endpoint where user B asks for user A's record and list in docs/ anything that is shared on purpose.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt