Trace the tenant context
Start at the authenticated request and follow the tenant identifier through application services, queries and downstream calls. Tenant context must be derived from trusted authorization, not accepted from an arbitrary browser parameter. Document where cross-tenant administration is explicitly allowed.
Look beyond the primary query
Background jobs, caches, search indexes, export files and object storage can bypass a carefully scoped web request. Include tenant identity in the design of each boundary. Ask how stale jobs, shared cache keys and guessed object identifiers behave.
Separate roles from isolation
A user’s role answers what they can do within an organization. Tenant isolation answers which organization’s data they can access. Test both independently, including users with more than one organizational membership and users whose access has been revoked.
Test negative cases deliberately
Use at least two tenants with recognizable test records. Attempt cross-tenant reads, writes, searches, exports and queued operations. Check that empty results, errors and aggregate counts do not disclose information from another workspace.
Define operational access
Support tools, backups, migrations and administrative reports need explicit access rules too. Decide who may inspect tenant data, under which approval, and with what audit record. Isolation is a lifecycle property that must survive routine operational work.
Review the complete organization boundary
- How is the active organization established for each authenticated operation?
- Do search, exports, queued work, files and support tools enforce the same boundary?
- What happens immediately after membership or permission is revoked?
Ask for a walkthrough using two organizations with separate records. Trace an ordinary request and an exception through the application, connected services and operational tooling.
SaaS & product engineeringFurther reading
OWASP Authorization Cheat SheetAWS SaaS Lens — tenant isolationAn editorial perspective for project planning. Requirements and implementation choices depend on your organization and systems.