The Laravel version of this exact failure is the global scope everyone adds to the tenant models and then quietly bypasses in the admin panel — one withoutGlobalScopes() in an export, one raw DB::select in a report, and the same class of leak opens. The registry idea is the part I'd steal: structural enforcement validated at write time rather than a scope applied at read time. StackShortlist's test suggestion is the missing piece, honestly. Without a failing test on registry drift, the registry becomes a convention with extra steps — and the eighth endpoint is only safe until someone adds the ninth relation by hand.