Design a REST API for a multi-tenant SaaS application. How do you handle tenant isolation at the data layer?