Tenant isolation
A tenant is a boundary, not a label in the UI. Replay objects you own across two organisations and record which identifier the server actually trusts.
Tags: tenant, idor, bac, saas
Checklist
- Two orgs you own: Create org A and org B with separate users. Do not use a customer tenant as the other side.
- Where the tenant is named: Path, host, subdomain, token claim, header, and body can each name an org. Write down which one changes the rows you see.
- Object replay: Take an object id from org A and request it with org B's session. Status, body, and whether a write lands are the result.
- Host versus token: When the host says org A and the token says org B, record which side wins for read and which side wins for write.
- Membership changes: Accept an invite, leave an org, and keep a stale tab. Note whether the old org cookie or token still authorizes.
- Role inside the org: Owner, member, and guest or external collaborator. Shared links should not grant the same writes as membership.
- Search, export, audit: Global search, CSV export, audit log, and notification lists. These often skip the tenant filter the UI applies.
- Jobs and files: A job or file created in org A should not be readable, cancelable, or downloadable from org B by id.