Tenant Isolation Is a Boundary, Not a Filter

If two customers share a platform and isolation is “UI only,” you have a liability.

Problem

Every request must answer: whose data is this? If the client supplies orgId and you politely believe it, you already lost.

Solution concept

1. Authenticate the caller
2. Load memberships
3. Bind tenant context for this request
4. Scope DB reads/writes to that tenant
5. Keep files/workspaces under the same identity

The org dropdown is a reminder, not the control plane.

Residual risk

Rare bypass paths need review. App filters without DB enforcement are thinner. Isolation shrinks blast radius, it is not absolute safety.

Try a real console - leave feedback

• nightingale-security.com
• Register
• Login

Review / discuss: GitHub Discussions #11