the Senses.
Perception. How the organism sees and serves the outside world. One record, many private views.
one view for everyone
76%
get frustrated
71% of consumers expect companies to deliver personalized interactions, and 76% get frustrated when this does not happen.
People expect their own experience. Give everyone the same one and they leave.
Everyone who uses your product expects to see their own data, and only their own. Teams usually get there one of two ways. They add per-user filters to a shared system, or they run a separate system for each audience. Both can be made to work. Both ask you to be perfect forever, either on every query a developer writes or on every system you keep running. There is a better place to put that guarantee.
where today falls short
One generic view is not perception, and an app-layer filter is where it leaks.
Serving each person their own private, correct view today means filtering in application code, with a WHERE clause the developer must remember to add on every read, in every path. Miss it once and a query returns rows that belong to someone else. App-level isolation depends on every query being written perfectly forever, so it eventually fails. The filter has to be enforced where the data lives.
The organ of perception
How the organism sees.
An eye takes one scene and renders the single image its owner needs to act. The Senses do the same with the record. Every audience queries the same governed data, and each is shown only the slice that belongs to them, enforced underneath and never assembled by hand. The diagram below follows one record as it becomes many private views.
the answer
One record, many private views. The database enforces who sees what.
Everyone queries the same table. There is no per-person system and no "if user is A" branch in the code. Row-level securityA rule the database engine enforces itself on every read and write. It filters which rows each person can see and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. on the person id gives each person only their own rows, enforced inside the database on every read, so the same source of truthThe one copy that counts. Every other copy is expected to match it, and when they disagree, it wins. projects to a different private view for each audience. Two people can query the identical record and never see a trace of each other. The isolation is guaranteed by the engine, not by remembering to filter.
more than a view
What one governed record has that a per-audience system doesn't.
One record can serve everyone and still show each person only what is theirs. The database decides what a person is allowed to see before any answer leaves it. That means a private view for every audience, with no separate system to pay for and no second copy of the data to keep safe.
One record, many views.
!Today A lone agent serves everyone the same generic view, and personalizing it means bolting on per-user plumbing.
the cell One source of truthThe one copy that counts. Every other copy is expected to match it, and when they disagree, it wins. projects to many private views, per role and per person. Change the record once and every view reflects it, because they are all the same record seen through different lenses.
Private by construction.
!Today A lone agent keeps two people apart with app-layer filters, and one missed WHERE clause leaks the wrong history into the wrong view.
the cell Two people query the same table and each sees only their own history. Row-level securityA rule the database engine enforces itself on every read and write. It filters which rows each person can see and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. on the person id enforces it inside the database, with zero app-layer filtering, so there is no query left to get wrong.
Serves the world, not just one account.
!Today A lone agent’s memory is one context; serving a second, separate customer means standing up a whole second system.
the cell The same governed record already serves an individual alongside an account, each one isolated and each one remembered. One organism, many tenants, proven beyond a single account.
from our own systems
The senses, serving today
This is not a mock-up. One governed record projects to a private view for every person, each isolated by row-level securityA rule the database engine enforces itself on every read and write. It filters which rows each person can see and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. and each remembered, and the same record already serves an individual alongside an account. The identities are never published; the mechanism is the proof.
KeyA green value is real, from our own database, as of Oct 8, 2026; in the diagrams, green marks a committed write.
what the senses read
4A real count from our own database, shown as proof rather than a claim. It is a dated snapshot, captured Oct 8, 2026.
governed schemas behind every private view
a real count from our own database, as of Oct 8, 2026
who sees what
per person
a private view for each person, isolated by the database
one record, many views
an individual
the same record serves beyond one account
zoom in
Down to a single allowed row
Each record is a row in the database. When one person looks through their private view of the data, the database checks every row against who is looking and hands back only the rows that person is allowed to see. One of those rows is the smallest unit of the senses. The database decides what exists for you before any app sees it.
- real client tenanciesone client’s account, kept apart from every other
×1 - per-user memory and isolationone person in that account, with a memory of their own
×2.5 - private viewsonly what that person may see, decided row by row
×6
Curious how a layer like this would fit your own records?