Separate User and Machine Authority
Keep a service credential from silently inheriting user privileges or expanding them.
An API request may begin with a human user, cross a queue, and finish under a machine account. If the worker treats its own broad credential as permission, the original user's limits disappear. If it blindly copies user claims from a message, those claims may be stale or forged. Design a caller-context contract for the handoff.
Delegation contract
Record three identities for each action: the initiating user, the executing service, and the target tenant or resource. Then state which one supplies each decision.
| Decision | Source of truth |
|---|---|
| May user request the job? | Current user membership and role |
| May service execute this job type? | Service grant |
| Which tenant is targeted? | Verified resource ownership |
| May delayed work continue? | Documented recheck or fixed grant rule |
| Who appears in audit? | Both user and service, with action ID |
Use an owned synthetic job to test an allowed request, a revoked user, a service missing a grant, and a message with a mismatched resource owner. Check data changes and external side effects. A service credential should never make a malformed request succeed because it can read all rows. A user claim should never give the service a capability it lacks.
The OWASP Authorization Cheat Sheet supports action-level checks. OWASP Multi Tenant Security emphasizes the tenant boundary. This contract joins those two: the user may initiate, but the machine executes only a bounded action on a verified target.
Record both actors
Illustrative delayed job: user U1 requests export E7 for tenant A; service S1 executes. At enqueue, record U1's export grant and S1's job-type grant. Before execution, revoke U1. Under a current-grant policy, E7 stops with no file. The audit record names U1 as initiator, S1 as executor, A as target, E7 as action, and the stop decision. Under another approved policy, record that rule and test it instead; the service credential must not decide by itself.
Write the stop behavior for uncertainty. Missing user context, expired permission, or unknown tenant must pause or fail the job without falling back to an all-tenant service identity. Keep this test within owned infrastructure or an exact written review scope. The result proves one handoff path, not all automation.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.