Test Organization Switching
Verify that tenant switching updates API, cache, and job context together.
A user can belong to two organizations, but a browser tab may retain data from the first after switching to the second. An API token, local cache, background request, or file link may still carry the old tenant. Treat switching as a state transition with multiple outputs, not as a menu change.
Switch-transition matrix
Use synthetic Tenant A and B records with distinct markers. Start as A, load a list and detail page, then switch to B. Check the following paths in order.
| Surface | Expected after switch |
|---|---|
| Visible navigation | B name and B-only links |
| API requests | B context derived from current trusted state |
| In-flight A request | Canceled, scoped, or safely labeled A |
| Client cache | No A data shown as B |
| Background job | Original tenant remains explicit |
| Browser back | A page rechecks current membership and tenant |
| Second tab | Documented synchronization or clear stale-state behavior |
The important decision is whether the application uses a current selected tenant, an explicit tenant route, or both. A request must not gain authority from a client-supplied selection alone. It must check that the current identity belongs to the selected organization and may perform the action.
Test rapid switching while a list request is pending. A late A response must not overwrite a B page without a visible boundary. Then remove membership in A and revisit its saved URL. Confirm that stale tokens or caches do not restore access. Record actual response bodies and cache keys in an owned test environment, with synthetic data only.
Check concurrent tabs
Illustrative tab-local selection rule: tab 1 stays on A while tab 2 selects B. Each request carries a selected tenant that the server verifies against current membership; neither tab may relabel the other's response. Hold A's list response, switch tab 2 to B, then release A's response. Require A-marker only in tab 1 and B-marker only in tab 2. If the product uses shared selection instead, make both tabs update or clear stale data under that documented rule before calling the test complete.
The OWASP Multi Tenant Security Cheat Sheet supports isolation across layers, and the authorization regression guide supports repeatable negative cases. The artifact is the transition matrix. It helps a team distinguish a confusing UI artifact from a server-side boundary failure. If switching behavior is undefined, resolve the product policy before calling a test a pass.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.