The group cockpit wants enterprise-wide views; subsidiaries legally cannot see each other's customers. Isolation and roll-up conflict—only permissions resolve it: row-level by organization, roll-up by authorized role, no detail broadcast. Ship one omniscient report then add permissions and you will leak data or legal stops you. Permissions before reports; tenant boundaries live in the model—not in "please do not click."
Roll-up is not showing everyone everyone's detail summed. It is showing sums to those authorized—others cannot query another org's rows at all.
Model Tenants First
Organization dimension on every fact table. Queries default with tenant predicate. Group roles use separate aggregate tables or secured views—no super-admin for daily analysis. Exports pass the same permissions—report "download" is not a bypass.
- Test two tenants cross-accessing—success is an incident.
- Post-merger transition gets its own tenant—do not mix databases first.
- Agents inherit the same row-level permissions—never wider.
Roll-up for Roles, Detail for Tenants
The XYN digital intelligence system trims data by organization; group analytics use authorized views. The tension remains but becomes manageable: those who need totals cannot see others' orders; those who need their orders cannot see group roll-ups. Permissions before reports—then the cockpit is both compliant and useful.
Open a group report with a subsidiary account. If you see others, close the report and add predicates. Reopen after fix—cheaper than apology.
