NewEvery agent tool call now routes through the governed MCP gateway — policy check, audit log, then dispatch.Read the changelogarrow_forward
XOOZLYAI Orchestrator
routeHow it workssmart_toyAgent fleetshieldGovernance & trustsellPricingmenu_bookDocsarticleBloghistoryChangelog
Log inStart free
grid_viewProductsrouteHow it workssmart_toyAgent fleetshieldGovernance & trustsellPricingmenu_bookDocsarticleBloghistoryChangelogHelp centreLog in
Start free
  1. XOOZLY
  2. chevron_rightEngineering & research
Loading the blog…
XOOZLYAI Orchestrator

Ready to orchestrate your AI fleet with total confidence?

Start a project, set a cost cap, and watch the loop run with every tool call policy-checked and logged before it leaves the platform.

Start freearrow_forwardSee what shipped
  • check_circleNo credit card required
  • check_circleYour keys, your model spend
  • check_circleEvery tool call audited

Platform

  • All productsarrow_forward
  • Orchestration looparrow_forward
  • Agent fleetarrow_forward
  • Governed control planearrow_forward
  • Pricingarrow_forward

Trust & legal

  • Trust centrearrow_forward
  • Security & compliancearrow_forward
  • AI use policyarrow_forward
  • Report a vulnerabilityarrow_forward
  • Data subject requestsarrow_forward

Resources

  • Documentation & guidesarrow_forward
  • Engineering & research blogarrow_forward
  • Changelogarrow_forward
  • Uptime & reliabilityarrow_forward

Browse by domain

  • Strategy & Researcharrow_forward
  • Developmentarrow_forward
  • QAarrow_forward
  • Governance & Orchestrationarrow_forward
  • All 10 domainsarrow_forward
XOOZLY
© 2026 XOOZLY · 61 agents · 10 domains · 8 SDLC stationsAI use policyarrow_forwardLog inarrow_forward99.9% uptime SLAarrow_forward
  1. XOOZLY
  2. chevron_rightEngineering & research
  3. chevron_rightDispatch
Loading this dispatch…
  1. XOOZLY
  2. chevron_rightEngineering & research
  3. chevron_rightTenant isolation as defence in depth, not as a single filter
Security & Trust

Tenant isolation as defence in depth, not as a single filter

Application-layer filtering and Postgres row-level security do different jobs. Shipping only one of them is the most common way a shared-schema tenant boundary quietly stops holding.

DPData PlatformverifiedSchema, RLS & tenant context·Jul 12, 2026·7 min read
𝕏in
On this page
  1. 01Two layers, not a choice between them
  2. 02The detail that makes it real
At a glance
shield_lockTWO INDEPENDENT REFUSALSApplication filter + row-level security, on every queryRuntime role is non-superuser, non-BYPASSRLS
Architectural questions?

The trust centre publishes the governance posture behind everything described here.

Open the trust centrearrow_forward
01

Two layers, not a choice between them

Every query that touches tenant-owned data filters on the project or organization explicitly, in application code. Row-level security in Postgres then refuses the same rows again at the database. Neither layer is a substitute for the other: the application filter is what makes the query correct, and the database policy is what catches the query that forgot.

02

The detail that makes it real

Postgres bypasses row-level security unconditionally for a superuser, no matter how the policy is declared. So the runtime connection role is deliberately not one — a detail that is easy to get wrong in a migration and silent when you do.

DPWritten by the Data PlatformSchema, RLS & tenant context. Dispatches from this team cover the parts of the platform they build and operate.

Related in the product

  • arrow_forwardTrust centre
  • arrow_forwardSecurity & compliance
Governed by default

Ready to govern your autonomous fleet?

Continuous guardrails, hard cost caps and an audit row behind every tool call — the same path this dispatch describes.

Start freearrow_forwardRead the trust centre
Suggested reading

More from the engineering blog

Explore all dispatchesarrow_forward
  • GovernanceAug 10, 2026

    Why we built a central MCP gateway instead of trusting agents directly

    Direct agent-to-tool connections create unmonitored credential use, missing audit trails and uncontrollable rate limits. Here is how one centralized proxy enforces policy, writes the audit row and dispatches — in that order — before a request reaches a third-party server.

    verified_userONE PATH PER TOOL CALLPolicy check → audit log → connector dispatchNo domain may bypass it
    8 min readRead article: Why we built a central MCP gateway instead of trusting agents directlyarrow_forward
  • AI OpsAug 03, 2026

    Inside the Rule Optimizer: proposals a human still has to approve

    How detected failure patterns in autonomous runs become proposed rule edits a human approves — and why approval writes a new version instead of editing one in place.

    Proposals auto-applied without review0%
    Input: run historyOutput: proposed version
    6 min readRead article: Inside the Rule Optimizer: proposals a human still has to approvearrow_forward
  • EngineeringJul 28, 2026

    Deterministic guardrails vs. probabilistic LLM evaluators

    Why we separate hard execution bounds from fuzzy evaluation loops, and what the fleet's 61 agents can and cannot do without an explicit grant.

    61/61Agents governed
    0Bypass paths
    6Steps per station
    11 min readRead article: Deterministic guardrails vs. probabilistic LLM evaluatorsarrow_forward