A client portal whose boundaries hold at the database.

The rules the contract enforces

These are written as Intent Specification Language (ISL) invariants, compiled directly into PostgreSQL row-level security and server action assertions. Break one and the transaction is refused at the database engine boundary.

domain ExecutiveClientPortal {
  entity ClientOrganization {
    id: UUID
    domain_identifier: String
    tier: Enum[Standard, Enterprise]
  }

  entity Deliverable {
    id: UUID
    organization_id: UUID -> ClientOrganization
    is_confidential: Boolean
    status: Enum[Draft, Review, Approved, Archived]
  }

  policy MultiTenantIsolation {
    invariant R01_StrictRowOwnership:
      forall d in Deliverable:
        Actor.canRead(d) requires (Actor.organization_id == d.organization_id)

    invariant R02_OnlyExecutiveSignoff:
      forall d in Deliverable:
        (d.status == Approved) implies
        (Actor.hasRole(Role.ClientExecutive) && Actor.organization_id == d.organization_id)
  }
}

• R01 Cross-tenant data queries are impossible Row-level security enforces that an authenticated actor cannot read or write records belonging to another organization, even if an ID is guessed.
• R02 Only client executives execute final approvals Reviewers may comment and submit feedback. The transition to Approved is strictly gated to executive credential holders.
• R03 Expiring tokens prevent permanent link leaks Sensitive document downloads use single-use or time-bounded signed URLs. Forwarding an old link yields an immediate denial.
• R04 All access is immutably logged Document views and status changes emit cryptographic audit events before data is returned to the client browser.

What ShipGate checks before this launches

Client portals carry your firm's reputation. ShipGate acts as an adversarial release authority, simulating cross-tenant intrusion attempts against a booted PostgreSQL instance before issuing a release certificate.

Frequently Asked Questions