Review the PostgreSQL boundary your multi-tenant SaaS depends on.
BoundaryCI reconstructs the authorization state left by ordered PostgreSQL migrations. Deterministic rules identify known RLS and SECURITY DEFINER failures; optional managed AI adds contextual review of tenant keys, memberships, policies, and privilege paths.
Focus AI-assisted review on tenant-boundary changes
General-purpose code review can produce broad suggestions. BoundaryCI narrows the question to one security invariant: can a valid action by one customer reach data or privileged behavior owned by another customer?
- RLS policy expressions and the row tenant key they constrain
- Membership joins that prove identity but not row ownership
- USING and WITH CHECK coverage across read and write operations
- SECURITY DEFINER functions and surrounding execution privileges
Keep known PostgreSQL failures deterministic
Missing RLS, unconditional policies, unsafe search_path, and default PUBLIC execution have narrow conditions that do not need probabilistic judgment. BoundaryCI reports those checks consistently and can block new high-severity regressions.
Managed AI supplements that foundation when the risk depends on relationships across multiple definitions. It does not silently replace the deterministic result or change the default exit code.
Review final migration state instead of isolated snippets
A later migration may drop, replace, rename, or re-grant an object. BoundaryCI follows migration order before evaluating the remaining state, reducing noise from SQL that no longer defines the deployed boundary.
The managed review receives locally redacted migration context only after an eligible organization explicitly authorizes it, giving the model enough surrounding information to reason about policy interactions.
Put findings beside the migration that introduced them
The GitHub Action returns file-aware annotations and preserves normalized results in BoundaryCI Cloud. Teams can compare corrected reruns, keep waivers owned and expiring, and separate deterministic findings from AI review signals.
bashnpx boundaryci scan . --profile postgres --fail-on highCombine migration review with active authorization tests
Neither static rules nor AI can observe live roles, claims, application queries, dynamic SQL, or operational access paths from migration text alone. Exercise at least two tenants in a disposable environment and independently review privileged service code.
Frequently asked questions
Can BoundaryCI AI review any PostgreSQL schema?
BoundaryCI is intentionally focused on ordered SQL migrations for multi-tenant authorization. It reviews RLS policies, tenant relationships, and privileged functions; it is not a general database performance or correctness analyzer.
Can an AI finding block a pull request?
AI findings are advisory by default. A team can explicitly include them in the exit decision after evaluating quality on its repositories, while deterministic checks continue to operate independently.
Does the scanner need PostgreSQL credentials?
No. BoundaryCI reads ordered migration files and does not connect to a production database. Runtime authorization testing is a separate layer teams should perform in a disposable environment.