Keeping each customer's data in its own room

Picture a hotel where the doors have no locks. Instead, the receptionist promises to check every guest's name before letting them upstairs. It works on a quiet Tuesday. Then it's a busy Saturday, there's a new receptionist, and somebody walks into the wrong room.

Nobody shouts. The guest just quietly finds someone else's suitcase.

The check you meant to add every time

Lots of software serves many customers from one system: one set of code, one database, everyone's data side by side. The usual way to keep it apart is a check in the code. Every time the software fetches data, it adds "and only for this customer".

I build software like this, and I've written that check more times than I can count. The first time, you've just been thinking about it, so it's right. The tenth time too. By the hundredth, it's a habit, and habits are what you stop looking at.

One gap is all it takes

The weakness is simple: every single place that fetches data has to get it right. A new screen built in a hurry. A late-night fix. A shortcut someone took to make a report faster. Any one of them is enough.

And when it fails, nothing breaks loudly. No error, no alarm. One customer just sees another customer's data, and the only warning is someone thinking "that doesn't look like ours".

Put the lock on the door

The rule: let the database itself keep customers apart, so the line holds even when the code forgets. Most modern databases can do this. You tell the database which customer a request is for, and from then on it won't hand back anyone else's data, whatever the code asks for.

The receptionist can still check names. But now every door has a lock, and a forgotten check opens nothing.

That covers a sneakier case too. A request often carries a number, like "show me order 4182". Swap in a different number and, if nobody checks whose order it is, you're reading a stranger's receipt. With the lock on the door, the wrong number just finds an empty room.

Why AI makes it matter more

When AI does part of the work, a leak travels further. A wrong record shown on a web page reaches one person, once. A wrong record handed to an AI becomes something it carries for the rest of the task, shaping what it writes, looks up and sends next.

By the time anyone reads a log, the stranger's data has been round the building. So the lock has to hold before the data ever reaches the AI.

What it costs

Starting fresh, it's cheap. Adding it to software that's been running for years is a real project. You find out which parts were quietly relying on the habit, usually by watching them break the day the locks go on.

Some jobs also need to see every customer on purpose, like a monthly report. Those get a clearly labelled master key, and somebody who knows exactly who holds it.

Both are good reasons to start early, while the building's still small.

The receptionist can stay. Just give the doors locks.