solarOS is multi-tenant at the Organization level: every tenant-owned table carries an organizationId column, and every query is expected to filter by it. Org API keys are themselves organization-scoped: a key created for one organization can't read or write another's records, and GET /api/v1/whoami (see API: authentication) is the fastest way to confirm which organization a key belongs to before you run anything else against it.

TODO(owner, likely engineering): write the full page. What enforces organizationId filtering (is it centralized in a query layer, or per-route), what happens on the rare record that's intentionally cross-tenant (platform-owned templates, for example), and how the Org API's tenant check differs, if at all, from the staff app's. Ground this in the actual Prisma query layer, not assumption.