Design a Tenant Role Permission Map
Translate tenant roles into explicit resource and action decisions.
“Owner,” “admin,” and “member” are names, not permission rules. A role may allow managing users but not exporting private data. Some resources are public to a workspace but editable only by their creator. Build a permission map that names the action and resource before adding route guards. OWASP Authorization recommends least privilege and explicit access decisions.
Permission map
For each role, write allowed actions on each resource class. Add a separate row for sensitive fields and bulk operations.
| Resource | Member | Admin | Platform support | Rule owner |
|---|---|---|---|---|
| Project | Read or edit assigned projects | Manage within tenant | No default access | Product team |
| Member list | Read limited fields | Invite and remove | No default access | Identity owner |
| Billing record | View own tenant if granted | Manage if granted | Separate support approval | Billing owner |
| Export | Explicit grant | Explicit grant | No default access | Data owner |
Do not make a blank cell mean “probably allowed.” Use deny by default until the owner records a rule. Also distinguish resource ownership from tenant membership. A user in the correct organization may still lack permission for a private project.
Turn each cell into at least one allowed and one denied synthetic test. Check routes, background jobs, and UI controls separately. The server decision is authoritative; hiding a button only improves usability. Record the role assigned at the time of the request, not only at login. A role change should affect active sessions according to a documented revocation policy.
Resolve disputed grants
Illustrative decision record for bulk export: resource=tenant projects; action=export; owner=data owner; rule=explicit export grant, not ordinary project read; approvedAt=the team's recorded decision date. Positive test: an A export-granted user receives only A approved fields. Negative test: an A read-only user creates no export job. Keep the cell pending until the actual owner approves the rule.
OWASP ASVS provides a verification framework, but it cannot choose the product's business permissions. This map is that local decision record. Review it with the people who own the resource, then version it alongside tests. If a new feature adds a resource without a row, the release checklist should flag it. Avoid claiming that one generic admin check protects every tenant action.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.