The scariest bug in a B2B SaaS isn't a 500. It's a 200 with someone else's data in it. I work at malibou, an HRIS that also runs payroll for its customers, built on Next.js with Clerk for authentication. Every row we serve belongs to exactly one company, and companies must never see each other. That sentence isn't hard to understand. What's hard is keeping it true on the 300th route, written by the 10th developer, on a Friday afternoon, and increasingly by a coding agent. Access contro...