GetConnects

1. Centralise tenant scoping in middleware. Take the target tenant from the authenticated session, not the body. Any endpoint that legitimately writes across tenants becomes an explicit opt-in with its own gate.
2. Reject client-supplied organisation on write endpoints. Prefer server-derived values.
3. Log tenant boundary violations at the middleware layer even when the request would otherwise pass. This surfaces attempted probes against any remaining gaps.
4. Add an integrity gate for downstream campaign or notification systems that verifies the segment's tenant matches the actor's tenant at execution time, so a stray segment cannot cause outbound traffic under a foreign tenant's brand.

Proof-of-concept request:

POST /api/segment/create HTTP/2
Host: [REDACTED]
Content-Type: application/json
Cookie: token=<valid_user_in_tenant_A>

{
  "json": {
    "name": "test",
    "organisation": "<target_org_id_in_tenant_B>",
    "criteria": {
      "and": [
        { "field": "firstName", "operator": "contains", "value": "a" }
      ]
    }
  }
}

The segment is created inside tenant B and appears in tenant B's downstream segment list, addressable by users in tenant B who legitimately have segment permissions.