Database-enforced rules restricting which rows a query can return.
Moves tenant isolation from developer discipline to enforcement below the application. The failure mode it prevents is a reportable breach, not a visible error, which is why convention is not an adequate control.