Design a multi-tenant SaaS authorization model where each customer organization's data must stay fully isolated.

Embed a tenant_id claim in every issued token (via a dedicated Authorization Server realm/configuration per tenant, or a custom claim mapper), and enforce it at multiple layers as defense-in-depth: method-level @PreAuthorize/@PostFilter checks scoped by tenant_id, repository queries that always filter by the current tenant, and ideally database-level row-level security or separate schemas so even a code-level bug can't leak cross-tenant data.