Platform security boundaryThe API re-validates tenant membership for every tenant-scoped request. Browser tenant selection is never the authorization boundary.