Why Authorization Checks Are Needed Even When the Company Name Appears in the Tenant Path
Use customer paths for navigation, but have the server authorize access to data. A company name in the URL does not replace authentication. If changing an identifier lets someone read other data, a separate menu is not a security boundary.