{
  "id": 17500248,
  "title": "Put the Workspace Check Inside the Database Write",
  "url": "https://urgent.news/2026/11/01/put-the-workspace-check-inside-the-database-write",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T00:22:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/smtasker-official/put-the-workspace-check-inside-the-database-write-2mbh"
  },
  "original_language": "en",
  "account": "SQLite offers a way to enforce workspace boundaries in database operations. When a record can belong to different workspaces, checking the workspace at the time of update is crucial to prevent unintended writes. The provided example demonstrates this using SQLite and Python.\n\nA sequence of steps shows a record being transferred from one workspace to another, then updated. The update statement lacks a condition to check the workspace, leading to the update of the record in the new workspace. By adding a workspace_id condition to the UPDATE statement, the code ensures that only rows from the correct workspace are updated.\n\nThe provided code defines a function to safely update the interval of automations, taking into account the principal's workspace_id and the validation of the interval. The function uses SQLite's RETURNING clause to fetch the updated row and checks if a row was actually updated. The tests confirm that the workspace is correctly enforced in the mutation.\n\nThis approach allows for a more secure and accurate database operation, ensuring that updates are made only to the correct workspace's records.",
  "summary": "A record can belong to workspace Alpha when you check it and workspace Beta when you update it. If the UPDATE filters only by record ID, the earlier check no longer protects the write. In the comments on the previous MCP permissions example , arun pointed out this database boundary . That example used an in-memory map. Moving the handler to a database needs one more decision: which rows is the…",
  "key_points": [
    "SQLite provides a method to enforce workspace boundaries in database operations.",
    "The provided code and tests confirm successful workspace enforcement in database mutations."
  ],
  "editors_take": "Integrating workspace validation directly into database update statements prevents accidental data corruption by ensuring that records can only be modified within their intended organizational boundaries.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}