- name: tenant-scoped-update
  where: "orders.py"
  ensure: >-
    The cancellation UPDATE must constrain tenant_id to actor.tenant_id before changing the order. An id-only or owner-only update breaks this requirement.