Scope Service Accounts by Tenant
Limit machine credentials to the tenant resources and actions they need.
A service account can be more powerful than the user who triggered it. A worker may hold a broad database key because it serves many tenants, then rely on a message field to choose the right one. Review the account's actual authority and each job's narrower intent. OWASP multi-tenant guidance applies to machine callers too.
Service-account grant register
For each account, record the service owner, credential storage, reachable systems, permitted operations, tenant scope, rotation path, and last review date. Do not store credential values in this register.
| Workload | Needed action | Possible overreach | Boundary test |
|---|---|---|---|
| Export worker | Read one tenant's approved rows | Read every tenant | Wrong-tenant job denied |
| Webhook sender | Deliver one tenant's events | Read unrelated payloads | Subscription owner checked |
| Search indexer | Copy owned records | Index another tenant under wrong label | Marker isolation test |
| Support task | Narrow approved access | Permanent broad grant | Expired grant denied |
Some shared workloads need a credential that can technically access multiple tenants. If so, identify the application policy that limits each operation and test it with a missing or false tenant context. “The worker is internal” is not a sufficient boundary. Prefer a narrower provider or database grant where the platform supports it.
Rotate a compromised or retired machine key at the provider. Stopping the worker does not revoke a copied credential. Verify that the replacement works and the old key fails. Keep account identity distinct from human identities so audit events can show the acting workload.
Test missing context
Illustrative export worker decision: service grant permits export execution; job J7 claims tenant A and record R7; stored R7 owner is B. Use a bounded owner-metadata lookup for R7. Reject J7 before the broad credential reads tenant data or writes a file. A second job with no tenant is rejected at envelope validation. Record job ID, service identity, claimed and stored owner, decision, and zero outbound calls. This does not assert that the provider can issue tenant-scoped credentials.
The OWASP Authorization Cheat Sheet gives the least-privilege principle. This register makes the residual broad access explicit. It is a planning and verification tool, not a claim that a tenant-specific key exists for every provider. Mark unsupported scope controls as unknown rather than inventing them.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.