Row-level security that fails closed

The design has three parts, and each answers one of the lesson's three Postgres rules: policies on every table that compare firm_id with the transaction's tenant (default deny), FORCE ROW LEVEL SECURITY so the owner is bound too, and an application role that owns nothing and can't bypass. The repository code never writes WHERE firm_id = …; if isolation holds, it holds because the database enforces it. The decision that matters most is attacking a real Postgres, not a fake: every interesting failure here is a Postgres behaviour.