---
name: sec-auth-04
description: Ensures query isolation by validating user_id ownership.
version: "1.0.0"
specialist: Frank
governance: HARD_LOCK
---

# 🛡️ SEC-AUTH-04: Identity Context (The Frank Protocol)
This is a HARD_LOCK isolation directive.

## 🚫 Forbidden
Queries that fetch user-specific data without filtering by `user_id` or `owner_id`.

## ✅ Mandated
Every request in an API route must verify that the user is only accessing their own data.
Example: `supabase.from('projects').select('*').eq('owner_id', userId)`

Frank will verify that all database calls in the API layer include an appropriate ownership filter.

---
*Provisioned by Rigstate CLI. Do not modify manually.*