DR-061 — Procurement databases are per-client single-tenant; there is no cross-tenant scope

Each client has its own database — procurement data is not multi-tenant. A dropped workspace_id predicate on a procurement route is therefore NOT a cross-tenant Authorization IDOR (the S467 flag on auto-map/route.ts was miscategorised — owner-corrected S470). The only real question on such a route is intra-DB form-instance scoping: can a key (e.g. templateId) bind rows across form instances within the same client DB? Under the form-first schema (form_instances_select RLS is USING(true), “no workspace-scoping concept”) child queries scope on form_instance_id = PK, so mis-binding is unrepresentable. Security reviews must not re-raise “cross-tenant” findings on procurement surfaces.