Test Tenant Feature Flag Boundaries
Verify that a feature flag never grants access outside its tenant or role policy.
A feature flag controls whether a feature is available. It should not replace authorization. A tenant-level flag can be enabled for Tenant A while a stale client or direct API call reaches the same route from Tenant B. Test both the flag decision and the underlying permission rule. OWASP Authorization supports explicit access checks at the action.
Flag-state test table
| Flag and caller state | Expected result |
|---|---|
| A flag on, A permitted user | Feature works within A |
| A flag on, A user without role | Action denied |
| B flag off, B user | Feature unavailable and action denied |
| A user requests B resource | Denied regardless of flag |
| Flag changes during session | Current rule applies |
| Flag service unavailable | Documented safe fallback |
Record where the flag value comes from and whether the client can alter it. A UI flag can hide a control, but the server still needs to check tenant ownership and action permission. For asynchronous work, record the flag policy at enqueue and decide whether to recheck it at execution.
Verify with synthetic tenants
Create A and B records and enable the feature for A only. Test the visible flow and direct app API route in an owned environment. Turn the flag off while a job is queued and apply the product's defined rule. Check database state, notifications, and export files after denied calls. Repeat with a role change and a stale browser tab. Do not treat a hidden button as evidence that the API is protected.
The OWASP Multi Tenant Security Cheat Sheet supplies the ownership boundary. This test table is useful when teams roll out a new feature by tenant. It separates availability from permission. If the fallback when the flag service fails is unclear, hold the release until the owner chooses and tests it.
Illustrative queued-export policy: A's flag and the user's export grant must be true both when J7 is enqueued and when its worker starts. Remove the grant while the flag remains on; J7 creates no file. Restore the grant, enqueue J8, then turn the flag off; J8 also creates no file. An authorized A request with both controls on remains the positive case. Record the actual product's continuation rule if it differs; a cached UI flag does not authorize the worker.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.