A Laravel global scope on tenant_id leaked all 200,000 rows to tenant 7 in 5 of 7 query paths: raw queries, withoutGlobalScopes(), queued jobs and joins.
Postgres Row Level Security with a non-owner role and a transaction-local set_config limited every path to the caller's 2,000 rows, and returned 0 rows when no tenant was set.
RLS added 0.076 ms per request in the lab, so keep the Eloquent scope for ergonomics and add RLS as the rule the database enforces.