a service_role client in a shared db module returned another org's invoices Multi-Tenant

Make the dangerous client hard to reach and easy to spot:

• One file, one export, named so it cannot be mistaken: adminDb from lib/admin-db.ts. Never a default export, never re-exported.
• An eslint no-restricted-imports rule that fails the build for any file outside lib/jobs/** importing it. This is fifteen lines of config and it is the actual fix.
• Keep the tenant predicate in the query even when using it. Defence in depth costs you one where clause.

And stop treating "RLS makes the plan bad" as a reason to bypass RLS. It is almost always a bare function call in the predicate, which is a two-character fix, not an architecture change.

One Postgres detail people miss: enabling RLS does not apply to the table owner. If your migrations run as the owner and your app connects as the owner, you have policies that do literally nothing.

alter table invoices force row level security;

That closes the owner hole. It does not stop a role with BYPASSRLS, which is what a service role is, so it is not a fix for your incident - but it is worth checking that your policies are on at all before you trust them.

Since you asked about structure and not comfort, one more: you now have a disclosure to make, and the customer who found it will ask whether anyone else saw their data. Make sure you can answer that from logs. Being able to say "three requests, all from your own account, here are the timestamps" is the difference between a rough week and losing the account.

Different angle: your request path should not have credentials that can bypass RLS at all. Give the web process a role without BYPASSRLS and put the admin credential somewhere the web process cannot read it - a separate worker with its own environment.

Then "someone imports the wrong client" fails at connection time in development instead of succeeding quietly in production. Permissions you cannot accidentally hold are better than permissions you promise not to use.

We keep the admin client in a package that is not in the web app's dependency list at all. You cannot import what is not installed. Slightly annoying in a monorepo, extremely effective.

four line diff, reviewed, nine days, 611 orgs. every incident I have ever been near has these same proportions.