ALTER TABLE credentials
  ADD COLUMN IF NOT EXISTS organization_id VARCHAR(40) NOT NULL DEFAULT 'org_system'
    REFERENCES organizations(organization_id);

CREATE INDEX IF NOT EXISTS idx_credentials_organization_id ON credentials(organization_id);

ALTER TABLE credentials ENABLE ROW LEVEL SECURITY;

CREATE POLICY credentials_org_isolation ON credentials
  USING (
    organization_id = COALESCE(
      current_setting('app.organization_id', true),
      'org_system'
    )
  );

ALTER TABLE credentials FORCE ROW LEVEL SECURITY;
