- Wrap SET LOCAL in transactions for proper connection pooling - Make workspaceId optional in query DTOs (derived from guards) - Replace Error throws with UnauthorizedException in activity controller - Update workspace guard to remove RLS context setting - Document that services should use withUserContext/withUserTransaction