{"id":"tenant_isolation_review_company_bellezapro_brand_bellezapro","companyId":"company_bellezapro","brandId":"brand_bellezapro","brandName":"BellezaPro","format":"markdown","content":"# Tenant Isolation Review local-only - BellezaPro\n\n- Estado: TENANT_ISOLATION_REVIEW_READY_LOCAL_ONLY\n- Empresa: BellezaPro\n- Marca: BellezaPro\n- Tenant scope: COMPANY_LEVEL_RLS\n- Access model: READ_ONLY_CLIENT_VIEW\n- RLS status: LOCAL_RLS_TARGET_DOCUMENTED_NOT_APPLIED\n- Production readiness: BLOCKED_BY_SECURITY_GATE\n- NO_CUSTODY_OF_FUNDS: true\n\n## Isolation checks\n\n- growth_company_members: Company-level RLS through growth_company_members (DOCUMENTED_LOCAL_TARGET)\n- no_anon_grants: No anon grants for Growth Platform tables (DOCUMENTED_LOCAL_TARGET)\n- brand_company_match: Brand belongs to requested company (PASS_LOCAL_DATASET)\n- read_only_portal: Client portal remains read-only (PASS_LOCAL_VIEW)\n- credential_references_omitted: Credential references and bank fields omitted from review (PASS_SANITIZED_OUTPUT)\n\n## Evidence required\n\n- supabase_rls_lint: Run Supabase RLS lint against local database (REQUIRED_BEFORE_PRODUCTION) docs/contracts/security-contract.md\n- two_user_rls_test: Validate two-user company isolation with authenticated users (REQUIRED_BEFORE_PRODUCTION) docs/contracts/data-contract.md\n- client_portal_read_only_review: Review client portal read-only access model (CLIENT_PORTAL_READY_READ_ONLY_LOCAL) /growth-platform/client-portal/company_bellezapro\n- security_preflight: Run local Security Gate preflight (REQUIRED_BEFORE_PRODUCTION) /api/security/preflight\n\n## Blocked decisions\n\n- production_tenant_readiness: Production tenant readiness (BLOCKED_BY_SECURITY_GATE)\n- public_client_portal: Public client portal exposure (BLOCKED_UNTIL_ACCESS_REVIEW)\n- live_provider_access: Live provider credentials or routing (PROHIBITED_LOCAL_ONLY)\n","productionReadiness":"BLOCKED_BY_SECURITY_GATE","productionEnabled":false}