Isolate Tenant Search Results
Trace tenant ownership through search ingestion, indexing, filtering, and result display.
Search systems often hold a second copy of tenant data. The database can enforce a correct policy while an index returns titles, snippets, counts, or identifiers from another tenant. AWS tenant isolation guidance distinguishes application-enforced and infrastructure-enforced isolation. An index needs its own documented boundary.
Draw the index path
Create a data-flow sheet for one searchable record type. Start with the database owner field. Note how the indexing worker reads it, which tenant value enters index metadata, and what the query service trusts when it builds a filter. End at every output: suggestions, full results, highlights, facets, and result counts.
| Stage | Required tenant fact | Failure to test |
|---|---|---|
| Ingest | Owner comes from stored record | Request body supplies a false owner |
| Transform | Owner survives normalization | Metadata is dropped on update |
| Query | Filter comes from authenticated context | Client changes tenant parameter |
| Return | Snippet and count use same scope | Hidden row appears in summary |
| Delete | Index copy is removed or isolated | Deleted record remains searchable |
Use two synthetic tenants with unmistakable but non-sensitive marker phrases. Rebuild the index from a clean state. Search as each member, update ownership in the owned test fixture if the product permits such moves, and delete one record. Check that stale index entries do not become visible while synchronization catches up. Record any documented delay as an exposure window that needs a policy decision.
Avoid treating a query filter alone as proof. A privileged worker, shared index alias, or search dashboard may bypass that filter. Identify who can call those paths. For pooled indexes, test each endpoint that presents search-derived content. For siloed indexes, verify that routing cannot select another tenant's index.
Check stale index entries
Illustrative lag fixture: the raw index still returns document D7 with owner A after its source row moves to B. Search as A and B before reindexing completes. A must not receive D7 merely because the stale index says A; the read path checks current source ownership or a current permission version before returning a snippet. B receives it only under B's present policy. Record raw hit owner, source owner, final response, and index delay separately.
The OWASP Multi Tenant Security Cheat Sheet supports layered checks. This artifact turns that principle into specific index assertions. Keep this work in an owned environment. Do not send a broad search probe to an unapproved customer system.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.