The /invoices/4821 example is the bug that shows up in almost every early SaaS review. Login passed, the session is valid, the invoice exists, and none of that says it belongs to this tenant. Hiding it in the frontend only means nobody has typed the number yet.

Resolving tenant context from server-side membership instead of a tenant_id in the request is the right default. I would add one habit: for every endpoint that reads or writes by ID, keep a test that logs in as tenant A and asks for something owned by tenant B. It is cheap, and it catches the one endpoint someone added in a hurry.

At Ascendra Ventures we put that cross-tenant check in the acceptance cases of any SaaS build, because retrofitting isolation after launch costs far more than designing for it in the first version.

Do you prefer enforcing this in the application layer, or pushing it down to row-level security in the database as a second line?