Django ORM

class TenantManager(models.Manager):
    def get_queryset(self):
        return super().get_queryset().filter(tenant=get_current_tenant())

class Document(models.Model):
    objects = TenantManager()  # All queries auto-scoped
    unscoped = models.Manager()  # Escape hatch for admin

# Middleware might set thread-local tenant
_thread_locals.tenant = request.user.tenant

# Manager reads it
def get_queryset(self):
    return super().get_queryset().filter(tenant=_thread_locals.tenant)

# Fetches by ID only - no user scoping
Document.objects.get(pk=pk)

# Includes user in query - scoped
Document.objects.get(pk=pk, owner=request.user)

# Unscoped - returns everything matching
Document.objects.filter(status='active')

# Scoped - only user's documents
Document.objects.filter(status='active', owner=request.user)

# If document is scoped but comments aren't...
document = Document.objects.get(pk=pk, owner=request.user)
comments = document.comments.all()  # Are these comments scoped?