Before you rely on branch isolation, run the census

An account with no branches recorded is not isolated at all. On one real tenant that was six accounts out of nine.

Run this before you rely on branch isolation

An account with no Accessible Branches recorded is not isolated at all. On one real tenant that was six accounts out of nine. So the first step is not configuration, it is a census.

It names the accounts that hold no branch. Enforcement is only as real as that list is short.

Then check the three places a branch is missing

• Warehouses. A warehouse with no branch belongs to nobody and is counted in for everybody. That is deliberate — hiding it would hide stock from the branch that holds it — but it should be a short list.
• Treasuries. Same rule. Thirteen tills across a real estate had been created through a screen that never sent the branch field, so they were filed nowhere.
• Journal entries. Historic entries predate the branch column. A single-branch view excludes them and says so, with the count and the total, and offers to include them in one click.

What a correct refusal looks like

Ask for another branch’s record by id: 404, the same answer as a record that does not exist. Not 403 — a 403 confirms the row is there, which is enough to enumerate a list one integer at a time.

And the one thing to grant

Isolation is not the same as permission. On a real tenant only one of ten non-superuser accounts held the permission to view treasuries at all, so the rest got a refusal long before scoping was reached. Grant the permission, then check the scope.