Tenancy
Tenancy is how the hub keeps one owner's data away from another's. Every row in the database says which ecosystem it belongs to.
When a request is handled, who is asking, and which ecosystem they are in, is bound into the database transaction itself, and the database refuses to show any row from another ecosystem. Hub staff can see across ecosystems; nothing else can. The account the application uses to talk to the database cannot switch this off, so a handler that forgets to filter still cannot read another owner's rows.
Above that, each handler narrows further, to what the caller owns, and chooses its scope deliberately: the caller's own ecosystem, a consistent snapshot for sync, public reads with no caller at all, the hub's own ecosystem, a bypass for staff, or a write into a named ecosystem.
When a handler answers with an error, the transaction still commits, because the error is the answer, not a failure of the work.