Multitenancy

Requirement A consumer selecting tenancy MUST record a Decision naming tenant source, storage model, isolation guarantee, administrative access, evolution path, and enumeration bound.

Rationale The Decision carries its owner, status, decider, and decide-by date. Approval waits while that Decision is a draft. The enumeration bound caps tenant identifiers in all-tenant records.

Requirement A multi-tenant decision MUST define shared-table, schema, or database isolation and state its guarantee and operating trade-off.

Rationale The selected storage model determines data isolation, operational complexity, and scaling behavior.

Requirement A multi-tenant system MUST NOT mix isolation models without a decision and data evolution plan.

Rationale Mixed models create unclear guarantees and operational recovery behavior.

Requirement A trusted host boundary MUST resolve tenant identity from verified claims, host mapping, or another authenticated source.

Rationale Trusted resolution prevents callers from selecting a tenant outside their authenticated context.

Requirement A tenant resolver MUST NOT accept an unrestricted tenant ID from request data.

Rationale Client-controlled identity can select another tenant's data boundary.

Requirement A protected multi-tenant operation MUST confirm actor and target tenancy, with the needed Permission held at the resolved scope and the target belonging to it.

Rationale Both the caller and requested resource need the same authorized tenant scope. The chain runs Actor holds Role at scope, Role allows Permission, and use case needs Permission.

Requirement An administrative cross-tenant operation MUST require a Permission the actor holds through a Role at platform scope, writing an audit record.

Rationale Exceptional access needs stronger visibility than normal tenant-scoped behavior.

Requirement A multi-tenant persistence implementation MUST resolve its tenant at session creation through the selected provider's own tenancy support.

Rationale Provider-supported tenancy gives queries and storage a consistent isolation mechanism. Session creation is the point that matters. A session opened without a tenant has an unscoped next query. Adding the filter per query instead leaves every new query one omission away from reading across tenants. The baseline provider resolves it from the registered tenancy at session creation, so no query carries the concern. An Entity Framework Core implementation resolves the tenant when the context is created and applies it through a query filter convention.

Requirement Every tenant-owned document, query, unique constraint, cache key, outbox record, job, export, and object-storage path MUST include tenant scope.

Rationale Omitting scope from one storage or background boundary can disclose or mix tenant data.

Requirement A cross-tenant resource response MUST use the documented not-found or forbidden policy.

Rationale The product chooses one disclosure outcome for unauthorized resource existence.

Requirement Errors, logs, metrics, and traces MUST NOT reveal another tenant's business identifiers or data.

Rationale Diagnostics can bypass an API response's normal resource-disclosure boundary.

Requirement Backup, restore, replay, deletion, export, support access, and incident investigation MUST document one-tenant or all-tenant scope.

Rationale Operating work can cause a broader data effect than one normal request.

Requirement An all-tenant operation MUST record actor, operation, reason, tenant count, and reached tenant identifiers up to the adoption Decision bound.

Rationale A documented scope states what an operation is allowed to touch. It does not state what one run touched, which is the question a tenant asks after an incident. An all-tenant run is also the one case where no tenant's own audit trail holds the whole event. The OWASP logging guidance treats an administrative action over many subjects as one event to record. When the audit extension is selected, the record is an audit record; otherwise it stays a standalone record.

Example A support export covering every tenant records the operator, the export, the tenant count, and the incident it was run for.