company_id is passed with every API call. You can persist the current company context in app state and switch it on user request (e.g., via a company switcher dropdown).company_id in requests that read or write data. This makes it easy to enforce boundaries, apply company-specific logic (e.g., invoice numbering rules), and maintain security.