# Isolate portfolios by landlord

**Status**: accepted

Each OIDC subject identifies one `Landlord`, and that landlord exclusively owns its apartments, leases, rent dues, payments, attachments, and generated documents. Every protected query and command is scoped and authorized by the authenticated landlord; the shared default portfolio is removed so contractual snapshots always identify one unambiguous landlord. This supersedes ADR-0001 and ADR-0010; multi-user portfolio membership remains deferred until it is required.