Map Tenant Data Boundaries Before a Review
Trace each tenant-owned record from entry point to storage and output before you review isolation.
A tenant boundary is not one check in one API handler. Data can leave through a list query, an export worker, a cache, a file link, or an internal dashboard. Start by mapping one important record type through every path that creates, reads, changes, and deletes it. The OWASP Multi Tenant Security Cheat Sheet treats isolation as a system property. AWS also separates identity from the mechanisms that isolate pooled resources.
The boundary map
Use one row per path. Do not mark a path safe only because its first screen asks for a tenant ID.
| Path | Input identity | Stored owner | Enforcement point | Output |
|---|---|---|---|---|
| Record detail | Authenticated user and membership | Tenant ID on record | Owner-bound lookup | One permitted record |
| Search | User context sent to index layer | Tenant metadata on indexed item | Retrieval filter | Suggestions and results |
| Export | Requester plus job identity | Tenant on source rows and output file | Worker query and download check | Temporary file |
| Support view | Staff identity and approved tenant | Tenant on target record | Scoped override | Redacted support data |
For your system, replace each example with the actual service, query, and permission rule. Mark unknown enforcement points as unknown. A service name alone does not prove that its queries apply the tenant constraint.
Follow one record end to end
Choose a synthetic record with an obvious tenant marker. Trace how the application assigns its owner at creation. Check whether update and delete paths derive the owner from trusted authentication context or from caller input. Then follow copies in search, analytics, logs, backups, and asynchronous jobs. Copies can outlive a primary row and can have different access rules.
Add an expected decision for two users: one member of the owning tenant and one member of another tenant. Include a public or shared record only when that state is part of the product. The map should show which layer makes each decision, not merely where an error appears.
Treat this as preparation for an owned or explicitly authorized review. It is not permission to probe another company's endpoints. If a path lacks an owner or enforcement point, hold the isolation claim until the product team can name and test it. The completed map is the input to a tenant authorization matrix, not proof that every route is secure.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.