When a screen asks for one customer’s requests, or one expert’s work, the request behind it carries the identifier to narrow by. If that identifier arrived unreadable, the list used to drop the narrowing and return every service lead in the account instead — the widest possible answer to a question that asked for the narrowest.

Those reads now stop instead. A list that cannot be narrowed the way it was asked to be narrowed returns an error rather than a broader set of rows, so a fault shows up as a fault rather than as somebody seeing more than they should.

No screen changes, and nothing anyone sees today moves: every part of the product already passed a valid identifier, which is why this never surfaced. The guarantee is now held by the service itself rather than by each screen remembering to do the right thing.