Enterprise and Tenant Switching

One user can belong to more than one tenant. After switching, menus, roles, organisation data, and business data are evaluated in the target tenant context.

The backend must validate tenant context server-side. Cache, WebSocket sessions, and asynchronous jobs must explicitly carry or clear tenant context to avoid cross-tenant data exposure.