Security · Guide
Tenant isolation needs a test map, not just a tenant column
Follow customer data through queries, files, jobs, and exports.
A list view can hide a deeper leak
An illustrative portal correctly filters its request list by company, yet its attachment download endpoint trusts a record identifier from the browser. The page looks isolated while the file path is not. Start a tenant test map with every way data leaves or changes: detail pages, search, exports, document previews, background jobs, model retrieval, and support tools. Each path needs an authorization decision tied to the authenticated caller.
Make the database a second boundary
PostgreSQL row security can restrict visible rows, but role configuration matters. Our recommended design uses application authorization plus database checks where suitable. Review whether the runtime role can bypass row security and how connection pooling sets tenant context. Never derive authority solely from a tenant field supplied in a request. Keep administrative maintenance paths separate and log their purpose without giving ordinary jobs administrative access.
Workflow at a glance
Use two deliberately similar customers
Create two synthetic companies with similar document names and overlapping employee names. Give a user access to one company and attempt every mapped path using the other company’s identifiers. Repeat with a staff member who belongs to both organizations, switching context between requests. Include cached responses and old job payloads. Similar fixtures expose accidental assumptions that random, obviously different test records may fail to reveal.
Define evidence and the remaining boundary
Store expected allow or deny outcomes alongside the tests, and run them after authorization or storage changes. A denied API call alone is insufficient if a cached download still works. Review failures as release blockers for the affected path. This approach does not make shared infrastructure equivalent to a dedicated environment; operational access, backups, and support processes still need explicit agreements appropriate to the customer’s requirements.
Track permission changes
Keep the test map near the authorization policy and review it when adding a role, cache, or export. Give each path an owner and a release check. Document deliberate administrative exceptions separately so a legitimate maintenance path does not quietly become unrestricted routine access.
Sources and further reading
- Row Security PoliciesRow Security PoliciesPostgreSQL · Documentation ·
- Authorization Cheat SheetAuthorization Cheat SheetOWASP · Documentation ·
Editorial approach
AI-assisted original writing, checked against linked public sources. Practical recommendations and illustrative scenarios are editorial analysis, not reported client results. Source dates and product details may differ from this collection’s preparation date.