diff --git a/docker-compose.yml b/docker-compose.yml
index 558beee..d62b9de 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -111,12 +111,12 @@ services:
         "^/collections/([^/]+)/items$":[["POST","stac:write"]],
         "^/collections/([^/]+)/items/([^/]+)$":[["PUT","stac:write"],["PATCH","stac:write"],["DELETE","stac:write"]],
         "^/collections/([^/]+)/bulk_items$":[["POST","stac:write"]]}
-      # # Row-level authorization (chapter 7): hide `private-<owner>-*` records from
-      # # everyone but the JWT whose `owner` claim matches.
-      # - ITEMS_FILTER_CLS=workshop_filters:TenantFilter
-      # - ITEMS_FILTER_KWARGS={"field":"collection"}
-      # - COLLECTIONS_FILTER_CLS=workshop_filters:TenantFilter
-      # - COLLECTIONS_FILTER_KWARGS={"field":"id"}
+      # Row-level authorization (chapter 7): hide `private-<owner>-*` records from
+      # everyone but the JWT whose `owner` claim matches.
+      - ITEMS_FILTER_CLS=workshop_filters:TenantFilter
+      - ITEMS_FILTER_KWARGS={"field":"collection"}
+      - COLLECTIONS_FILTER_CLS=workshop_filters:TenantFilter
+      - COLLECTIONS_FILTER_KWARGS={"field":"id"}
     volumes:
       # `PYTHONPATH=/app/src` in the proxy image, so this is importable as-is.
       - ./docs/workshop_filters.py:/app/src/workshop_filters.py:ro