Scope Tenant Data Exports
Protect the full export lifecycle, from request authorization to file download and expiry.
An export crosses several boundaries. The user requests it, a worker reads records, a file appears in storage, and a later download link returns it. Checking only the request endpoint leaves the worker and file exposed. The OWASP Multi Tenant Security Cheat Sheet treats tenant isolation as a complete data path.
Trace the export state
| Stage | Identity and owner check | Evidence |
|---|---|---|
| Request | Caller may export this tenant's data | Permission decision and job ID |
| Queue | Job carries a trusted tenant context | Serialized job envelope |
| Worker | Query is bound to tenant and allowed fields | Query or policy test |
| Storage | File owner and retention are recorded | Object metadata |
| Download | Current caller or explicit recipient is authorized | Denied-link test |
| Expiry | File and link become unusable | Cleanup result |
Use a synthetic export with two tenants and marker rows. As a member of Tenant A, request an export and check that its file contains only A data. Remove the member before download and test the product's revocation rule. If the product intentionally permits an issued file link to remain valid, document that as a separate capability and set a short expiry; do not assume changing a UI role revokes a copied link.
Check the worker's credential. A broad service key may read all rows, so the job must apply a verified tenant predicate or equivalent isolation policy. Also inspect counts, filenames, notifications, and error logs for tenant data. A failed export should not leave a readable partial file. Record the build, job ID, file hash, and deletion time in the test evidence without copying customer content into the evidence record.
Decide the revocation rule
Illustrative policy for a sensitive export: recheck current export grant when the worker starts and current download grant when the file is requested. Queue A job J7, remove the requester's grant, then release J7; require no file or notification. For a file issued before removal, require the app download route to deny. Test any copied storage-signed URL separately under its actual expiry policy; do not claim this app check revokes that capability. The product owner must approve a different continuation rule before use.
Exports can be large and sensitive. Rate and volume controls need an owner, but do not present a generic limit as safe for every product. The OWASP authorization guidance supports action-specific permission checks. Keep the scope question separate from implementation: who may export which fields, and for how long? Hold release if the team cannot answer that for every stage.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.