48PLATFORM SECURITY

Multi-Tenant Isolation

Security infrastructure cannot ask customers to accept weak multi-tenancy.

Priority: P0
Phase: Foundation
Primary owner: Platform Security
Status: Blueprint

Objective

As a security vendor, a cross-tenant data leak would be existential. Tenant isolation must be designed across identity, database access, object storage, caches, queues, analytics and support tooling—not assumed from application-level filters alone.

What to build

Tenant-scoped authorization on every data-access path.
Strong database row/partition controls and service-layer checks.
Separate object-storage namespaces and encryption context.
Tenant-aware queues, caches and search indexes.
Privileged support access with approval and auditing.

Implementation decisions

Automated negative tests for cross-tenant access.
Never trust tenant IDs supplied by unverified client inputs.
Use tenant context propagated from authenticated identity.
Design enterprise dedicated/regional options without forking the product.

Definition of done

Automated tests demonstrate no cross-tenant reads/writes across major stores.
Support/admin access is visible and time-bounded.
Backups/restores preserve tenant isolation guarantees.

Success metrics

Cross-tenant test coverage
Support elevation events
Isolation defects
Tenant-scoped restore success

NON-NEGOTIABLE

Security infrastructure cannot ask customers to accept weak multi-tenancy.