Protect database writes

For some class of database writes we should be able to fairly easily protect against writing outside the current organization from within Ruby on Rails.

We need to be mindful to minimize secondary queries and their impact.

This relates to #548417