Every tenant table in Pulse carries an organisation id and its policies from the migration that created it, so isolation is a property of the row rather than a clause somebody has to remember. Here is what that prevents, and the three times we still got it wrong.
A candidate marked in process tells you nothing about whether anyone has touched it in three weeks. A status is a claim somebody typed once. An activity timestamp is an event, and it cannot go out of date.
The marketing site we started from attributed six invented quotes to real people by name and claimed forty agencies were using a product that had not shipped. Both are gone, the layout stays, and the slot is empty on purpose.