Check Tenant Notification Recipients
Verify that each notification reaches only current, authorized recipients.
A tenant boundary can fail after the main action succeeds. An export completes for Tenant A, then a notification service sends the link to a former member or a contact in Tenant B. Recipient selection is an access decision. The OWASP Multi Tenant Security Cheat Sheet applies to these derived outputs.
Recipient decision table
| Event | Recipient source | Check before send |
|---|---|---|
| Export ready | Requester or named delegate | Current download permission |
| Member invited | Verified address on invite | Tenant and intended role |
| Billing change | Tenant billing contacts | Active role and tenant |
| Security alert | Approved tenant administrators | Current alert subscription |
| Support note | Internal case owner | Case access and redaction |
Separate the content of a message from its recipient list. Even a subject line can reveal a tenant name or event. A link with independent access checks reduces risk but does not excuse sending private context to the wrong address.
Test time and ownership
Use synthetic A and B accounts and a local or test mail sink. Trigger each event and inspect the queued recipient list and rendered message. Remove an A member after the event is queued but before delivery, then check the product's documented rule. Test a stale email address and a user who belongs to both tenants. Confirm that deduplication does not merge recipients across tenant contexts.
The OWASP Authorization Cheat Sheet supports checking the relevant action at the time it occurs. The artifact is a recipient-resolution table with current membership and data-class rules. Do not send test notifications to real customer addresses. If the send worker cannot recheck permission, limit the message to a safe notice and require fresh authorization before any sensitive download.
Illustrative delayed export notice: event E7 names tenant A and requester U1; its queued recipient list is not final. After U1 loses download permission, resolve E7 again. Expected artifact: delivery=skipped, recipients=[], renderedSubject=null, link=null. If a safe notice to a separate current admin is required, record that admin's grant before rendering it.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.