diff --git a/compose/service/module.go b/compose/service/module.go
index 457a96e89..5384988cf 100644
--- a/compose/service/module.go
+++ b/compose/service/module.go
@@ -86,6 +86,11 @@ const (
 	moduleChanged       moduleChanges = 1
 	moduleLabelsChanged moduleChanges = 2
 	moduleFieldsChanged moduleChanges = 4
+
+	recordTable            = "compose_record"
+	recordFieldID          = "ID"
+	recordFieldModuleID    = "moduleID"
+	recordFieldNamespaceID = "namespaceID"
 )
 
 const (
@@ -1232,6 +1237,8 @@ func modulesToModelSet(dmm dalModelManager, ns *types.Namespace, mm ...*types.Mo
 
 			// @todo validate ident with connection's ident validator
 
+			model.Constraints = modelBaseConstraints(model, mod)
+
 			model.ConnectionID = connectionID
 			out = append(out, model)
 
@@ -1259,6 +1266,21 @@ func modulesToModelSet(dmm dalModelManager, ns *types.Namespace, mm ...*types.Mo
 	return
 }
 
+func modelBaseConstraints(model *dal.Model, mod *types.Module) (out map[string][]any) {
+
+	// If we're writting to the default table apply additional constraints
+	// @todo there should be more logic here, but for now this is what we had
+	//       elsewhere.
+	if model.Ident == recordTable {
+		out = map[string][]any{
+			recordFieldModuleID:    {mod.ID},
+			recordFieldNamespaceID: {mod.NamespaceID},
+		}
+	}
+
+	return
+}
+
 // ModuleToModel converts a module with fields to DAL model and attributes
 //
 // note: this function does not do any partition placeholder replacements
diff --git a/compose/types/record.go b/compose/types/record.go
index 65de78bfa..94bb5a9af 100644
--- a/compose/types/record.go
+++ b/compose/types/record.go
@@ -96,30 +96,12 @@ const (
 	OperationTypeCreate OperationType = "create"
 	OperationTypeUpdate OperationType = "update"
 	OperationTypeDelete OperationType = "delete"
-
-	recordFieldID          = "ID"
-	recordFieldModuleID    = "moduleID"
-	recordFieldNamespaceID = "namespaceID"
 )
 
 func (f RecordFilter) ToConstraintedFilter(c map[string][]any) filter.Filter {
 	return filter.Generic(
 		// combine constraints with namespace and module
-		filter.WithConstraints(func() map[string][]any {
-			if c == nil {
-				c = make(map[string][]any)
-			}
-
-			if f.ModuleID > 0 {
-				c[recordFieldModuleID] = []any{f.ModuleID}
-			}
-
-			if f.NamespaceID > 0 {
-				c[recordFieldNamespaceID] = []any{f.NamespaceID}
-			}
-
-			return c
-		}()),
+		filter.WithConstraints(c),
 		filter.WithExpression(f.Query),
 		filter.WithOrderBy(f.Sort),
 		filter.WithLimit(f.Limit),
diff --git a/pkg/dal/model.go b/pkg/dal/model.go
index 97f95eaca..915a88cad 100644
--- a/pkg/dal/model.go
+++ b/pkg/dal/model.go
@@ -34,6 +34,8 @@ type (
 		Attributes AttributeSet
 
 		Operations OperationSet
+
+		Constraints map[string][]any
 	}
 	ModelSet []*Model
 
diff --git a/store/adapters/rdbms/dal/model.go b/store/adapters/rdbms/dal/model.go
index a5396a4fa..0b7955e02 100644
--- a/store/adapters/rdbms/dal/model.go
+++ b/store/adapters/rdbms/dal/model.go
@@ -4,9 +4,10 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"strings"
+
 	"github.com/cortezaproject/corteza-server/pkg/errors"
 	"github.com/modern-go/reflect2"
-	"strings"
 
 	"github.com/cortezaproject/corteza-server/pkg/dal"
 	"github.com/cortezaproject/corteza-server/pkg/filter"
@@ -252,7 +253,15 @@ func (d *model) searchSql(f filter.Filter) *goqu.SelectDataset {
 		//}
 	}
 
-	for ident, vv := range f.Constraints() {
+	cc := f.Constraints()
+	if d.model.Constraints != nil {
+		for k, c := range d.model.Constraints {
+			// Overwrite user-provided constraints as the system ones are more important
+			cc[k] = c
+		}
+	}
+
+	for ident, vv := range cc {
 		attr := d.model.Attributes.FindByIdent(ident)
 		if attr == nil {
 			return base.SetError(fmt.Errorf("unknown attribute %q used for constrant", ident))