Limit Bulk Export Authority
Give bulk exports a separate grant, size policy, and audit record.
A user who can read one record may not need permission to export every record in a tenant. Bulk export changes the impact of a mistake and can create durable files outside the normal app. Make it a named capability rather than inheriting ordinary read access. The OWASP API Security Top 10 includes authorization and unrestricted resource use among API risks.
Export permission worksheet
| Decision | Product-specific answer |
|---|---|
| Eligible role | Which role may start a bulk export? |
| Data set | Which record types and fields are included? |
| Tenant | Which owner context constrains the query? |
| Volume | What limit prevents accidental excessive work? |
| Approval | Is a second decision needed for sensitive data? |
| Delivery | Who may download, and when does the file expire? |
| Audit | Which actor, scope, and result are recorded? |
Choose a row limit from data sensitivity, workload capacity, and user need. A report of “500 rows” says little without knowing whether those rows are public summaries or private customer records.
Exercise the boundary
In staging, create two synthetic tenants with distinct markers. Confirm that a read-only member can use allowed single-record reads but cannot start an export without the grant. Test an authorized export and inspect every row and field. Then revoke the grant while the job is queued and apply the documented continuation rule. Check that denied requests create no file or delivery link.
The OWASP Multi Tenant Security Cheat Sheet supports tenant-scoped access across workers and storage. This worksheet distinguishes authorization from rate control and file lifecycle. Keep the actual scope in a private record. If export permission is bundled with a broad admin role, document that choice and its consequences before claiming least privilege.
Record the export format and destination in the worksheet. A CSV emailed to an external address has a different exposure path from a short-lived download in the app. Test the chosen delivery path, not only the database query that creates the file.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.