Security Boundary

AI will not guess your privacy rules

What it does

Says out loud that customers must never see each other's things, and puts that rule in the database, where the rest of the code cannot forget it.

When to use it

Any app where two customers' data must never meet.

The prompt

This app has more than one customer in it. Somebody from
customer A must never receive anything belonging to customer B
— not on the screen, not in the data sent to their browser,
not buried in a file the browser downloads.

Put that rule in the DATABASE, not in the code around it.
Assume the code around it will be wrong one day.

Give it to me in this order:
1. The database change, and the rule itself
2. The test that proves one customer cannot reach the other
3. The screen, last

Ways to use it

• Swap “customer” for user, team, or workspace — same idea
• Ask for the test that fails first, then the fix
• Run it again as a check on something you already put live

Test log

Each prompt was pasted into a fresh private chat with memory off and graded against pass standards written before the run (all of them, dated).

The pass standard for this prompt: five criteria and an automatic-fail rule, written down on September 27, 2026, before any run.

Related words

• constraint block — The part of your prompt that says what the AI is not allowed to do: which tools, which files, which lines it must not cross.
• blast radius — How far a change can reach: every file and every behaviour it could possibly touch.