Resolve a record id within the caller's own tenant, or refuse.
Contracts
Resolve a record id within the caller's own tenant, or refuse.
The guard every write in this schema starts with. It is not a convenience: an id that belongs to another organisation must fail as not-found rather than as forbidden, because the second answer confirms the row exists.
GET
Resolve a record id within the caller's own tenant, or refuse.

