Sourced / Security blog
Tenant Isolation & API Authorization
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
63 articles / Page 2 of 3
- Tenant Isolation & API Authorization
Isolate Search Autocomplete by Tenant
Check suggestions and counts that appear before a full search result.
- Tenant Isolation & API Authorization
Isolate Tenant Search Results
Trace tenant ownership through search ingestion, indexing, filtering, and result display.
- Tenant Isolation & API Authorization
Isolate Tenant Vector Retrieval
Bind vector records and retrieval filters to verified tenant ownership.
- Tenant Isolation & API Authorization
Limit API Object Properties by Role
Define field-level read permissions before serializing API objects.
- Tenant Isolation & API Authorization
Limit Bulk Export Authority
Give bulk exports a separate grant, size policy, and audit record.
- Tenant Isolation & API Authorization
Map SSO Users to Tenants
Define how a verified SSO identity becomes a tenant membership and role.
- Tenant Isolation & API Authorization
Map Tenant Data Boundaries Before a Review
Trace each tenant-owned record from entry point to storage and output before you review isolation.
- Tenant Isolation & API Authorization
OpenAPI Security: API Keys, Schemas, and Auth
Fix API key declarations and readOnly/writeOnly schema gaps, then test that your API enforces its documented security requirements.
- Tenant Isolation & API Authorization
Partition Cache Keys by Tenant
Check that cache keys cannot return one tenant's data to another.
- Tenant Isolation & API Authorization
Plan a Tenant Data Migration
Move one tenant between data stores without changing who can access it.
- Tenant Isolation & API Authorization
Prevent Cross-Tenant CDN Cache Leaks
Classify authenticated responses before an edge cache can store them.
- Tenant Isolation & API Authorization
Protect Tenant Detail Links
Ensure direct record links enforce current membership, even when a user saved the URL earlier.
- Tenant Isolation & API Authorization
Protect Tenant Pagination Cursors
Bind a pagination cursor to the tenant, filter, and permission context that issued it.
- Tenant Isolation & API Authorization
Redact Tenant Data in Logs
Define which tenant fields may enter shared logs and how to verify redaction.
- Tenant Isolation & API Authorization
Reject Untrusted Tenant Headers
Derive tenant context from verified membership instead of trusting a caller-supplied header.
- Tenant Isolation & API Authorization
Remove Sensitive API Error Details
Define error fields that help clients without exposing tenant data or internal secrets.
- Tenant Isolation & API Authorization
Review Organization Invite Boundaries
Map who may invite, accept, promote, and revoke members in a tenant.
- Tenant Isolation & API Authorization
Route Callbacks to the Correct Tenant
Resolve a verified provider callback to the owning tenant before changing records.
- Tenant Isolation & API Authorization
Run Authorization Regression in CI
Keep allowed and denied tenant access tests in the release pipeline.
- Tenant Isolation & API Authorization
Scope Cross-Tenant Integrations
Bind each external integration to its tenant owner and verify every use against current access.
- Tenant Isolation & API Authorization
Scope Idempotency Keys by Tenant
Bind idempotency records to the caller, tenant, operation, and request meaning.
- Tenant Isolation & API Authorization
Scope Service Accounts by Tenant
Limit machine credentials to the tenant resources and actions they need.
- Tenant Isolation & API Authorization
Scope Tenant Data Exports
Protect the full export lifecycle, from request authorization to file download and expiry.
- Tenant Isolation & API Authorization
Scope Object Storage by Tenant
Trace tenant ownership from database rows to blob keys and access policies.