A portal whose isolation is proved, not asserted

What it is, and what it is not

A workspace for external organisations — manufacturers, distributors, contract manufacturers — where they see the specific objects at the specific revisions you shared, and nothing else in the tenant.

It is not a separate application with its own copy of the data. A second copy is a second thing to keep current, and the failure mode is a supplier working from a package that stopped matching the source three revisions ago.

It is also not a permissions role. An external organisation is a different kind of principal from an employee with restricted access, and modelling it as the latter means one forgotten check away from a supplier seeing a competitor's part. The distinction is enforced in the data layer rather than in a role definition.

The mechanism: a second narrowing, below the query

Every request already carries a tenant context that the database client extension turns into a predicate on every query. When that context carries an external organisation identifier, the extension narrows again — to the objects explicitly shared with that organisation.

Both narrowings happen below the query builder, so there is no route, report, export or autocomplete endpoint that can accidentally skip them. A per-page check would fail silently at the one page somebody forgot, and the bug would be an absence that no code review reliably catches.

The requirement includes direct fetch. A supplier session requesting an unshared object by its identifier is refused — not shown an empty page, refused — and the refusal is shaped so it does not confirm the object exists. There is a test that attempts exactly this and asserts it fails, because a negative has to be proved rather than assumed.

Counts obey the same clause. A facet or a total that included unshared objects would announce their existence as effectively as listing them, so results, totals, facets and pagination all derive from one where.

The failure it prevents

A contract manufacturer building for two competing customers has a login for each. In a system where external access is a permissions role, the boundary between those two accounts is a set of checks distributed across every screen, report and export the product has.

It only takes one — an autocomplete that queries part numbers for a search box, an export job that runs outside a request context, a report aggregating across a table the ordinary screens never touch. None of those look like security surfaces during review.

The consequence is not a nuisance. A competitor's part number appearing in a supplier's search results is the kind of incident that ends a manufacturing SaaS company, and the reason is always the same: the control was in the application rather than under it.

How it meets the rest of the product

Sharing is by object and revision, so a supplier sees the drawing at the revision you shared rather than whatever is current. When a new revision releases, the share updates or the supplier sees the old revision marked superseded — never a silent substitution under their feet.

That makes the portal strictly better than issuing controlled copies where it is available: there is no file in the supplier's hands to go stale, and no register to reconcile. The controlled copy machinery exists for the cases where somebody genuinely needs a document outside the system.

Supplier change notifications, requests for quotation, corrective action requests and quality responses all run through the same surface, so a supplier has one place to look rather than an email thread and a portal that disagree.

Every supplier action is an attributed audit row like any other. Who downloaded which revision, when, and who acknowledged a change notice are questions with answers rather than inferences from an email archive.

How it meets your ERP

The portal shows engineering data — drawings, specifications, structures, change notices, quality requests. It does not show purchase orders, delivery schedules or invoices, because those are your ERP's and most ERPs have their own supplier-facing surface.

That split is deliberate rather than a gap. A supplier portal that showed both would need to reconcile two systems' views of a commercial relationship in front of the counterparty, which is the worst possible audience for a discrepancy.

The supplier record itself masters in your ERP — terms, pricing, the vendor part number a buyer transacts against. Manufacturing PLM holds which manufacturer parts engineering has approved, and the portal identity links to the ERP supplier through the same matching rules as everything else.

Where the boundary is

Supplier seats are free and unlimited, deliberately — a supplier who will not pay to answer your change notice does not answer it, and the notice going unacknowledged is your problem rather than theirs.

What the portal does not do is give suppliers a place to edit your product data. They respond, acknowledge, upload declarations and answer corrective action requests; they do not change structures or revise documents. A supplier with write access to a released structure is a change process with a hole in it.