- name: tenant-scoped-lock
  where: "orders/cancellation.py"
  ensure: >-
    Before mutating an order, the locked queryset must filter tenant_id by actor.tenant_id. Matching owner_id without the tenant restriction is insufficient.