Task — engineering-spec@1

"Fail-closed RLS on brain tables (drop NULL-GUC arm + nil-uuid bypass)"

draftTASK-MEMORY-202
module memory · class product · priority p0 · created 2026-07-08 · shipped null
depends on none · blocks none

TASK-MEMORY-202: Fail-closed RLS on brain tables (drop NULL-GUC arm + nil-uuid bypass)

1. Description

query without app.tenant_id returns zero rows; admin paths use dedicated role, not magic uuid

Migrated 2026-07-08 from the memory improvement backlog, folded into the task system as class: improvement. Source report refs: R74, F16.

Acceptance criteria

Implementation status (reconciled 2026-07-08)

Implemented on branch auto/memory-enterprise (commit 2441825, migrated from MEM-002). The code exists in services/memory/; author this task's section-1 clauses from the implementation and source report before it moves through the review/test gates.