Logging in proves who someone is, not what data they should see.
One filter in app code. One shared cache. One unfiltered export. That's a breach.
Row-level security filters every report and export:
https://www.boldreports.com/blog/row-level-security-in-multi-tenant/
