@@ -169,3 +190,3 @@
         if not project_names:
             return []
-        scoped = ScopedBackendView(allowed_projects=project_names)
+        scoped = ScopedBackendView(

@@ -0,0 +222,4 @@
+        v: frozenset[str] | list[str] | set[str],
+    ) -> frozenset[str]:
+        """Accept list/set and convert to frozenset."""
+        if isinstance(v, (list, set)):

@@ -0,0 +312,4 @@
+        if resource_id:
+            return self.is_resource_in_scope(resource_id)
+
+        return True

@@ -0,0 +422,4 @@
+            A new ``ScopedBackendView`` configured with the scope's
+            resource IDs and project names.
+        """
+        return cls(

@@ -0,0 +781,4 @@
+
+    for project in projects:
+        project_names.add(project.namespaced_name)
+        for lr in project.linked_resources:

@@ -0,0 +152,4 @@
+            Whether the path passes the filters.
+        """
+        pp = PurePath(path)
+        if self.include_paths and not any(

@@ -0,0 +244,4 @@
+        v: frozenset[str] | list[str] | set[str],
+    ) -> frozenset[str]:
+        """Accept list/set and convert to frozenset."""
+        if isinstance(v, (list, set)):

@@ -0,0 +314,4 @@
+
+        return True
+
+    # -- Backend-level query proxying ----------------------------------------

@@ -12,0 +21,4 @@
+  allowlist/denylist filtering. `validate_project_scope()` and
+  `validate_resource_scope()` guard against out-of-scope access. Three enforcement
+  hooks added to `ContextTierService`: `get_scoped_by_resource`,
+  `validate_fragment_scope`, `store_with_scope_check`. Includes 67 Behave BDD

@@ -0,0 +37,4 @@
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `resource_ids` | `frozenset[str]` | Resource ULIDs in scope (min 1) |

@@ -0,0 +1,1163 @@
+"""Step definitions for scoped backend view filtering.

@@ -121,6 +136,45 @@ class ContextTierService:
 
         return None
 
+    def get_scoped(