# Tenant-isolation audit

Follow one request's verified customer and permissions through the whole service. These North/South cases are hypothetical paper designs. The checks below have not been run and do not establish platform isolation or compliance.

## Completed teaching example

Two customer organizations, North and South, share the service. Each has a document called AP-1. A tenant is a customer organization sharing that service; its identity comes from trusted authentication and membership checks, not an email domain, document name, or model-selected argument.

Failure: North's answer is cached under `policy:AP-1`. South passes its own login check and retrieves that same key. Correct source-database filtering did not prevent a cache disclosure.

Required repair: North's AP-1 answer and South's AP-1 answer must use separate cache entries. Then check sharing within North: two readers may have different document or field permissions, so a North label alone is still too broad. Each entry must identify the verified customer, resource and source versions, and the permissions and policy under which it may be shared. Check current access and source age before returning it. Define when to invalidate or refuse an entry after a source, permission, deletion, or policy change.

Second case: Alice requests work under her North membership. The delegated job waits. North removes Alice's membership before resume. The worker checks her current authority and stops further unauthorized reads and disclosure, even if its service account is more powerful. A separately authorized unattended workload requires its own explicit current grant; it cannot silently adopt Alice's stopped request.

| Location                                    | Verified binding or required check                                                                                                                              | Failure case                                                                          |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Initial request                             | Identity, current membership, resource, purpose, and intended recipient                                                                                         | User or model supplies another customer ID                                            |
| Source lookup                               | Current permitted rows/fields for the verified customer                                                                                                         | Source query bypasses a filter                                                        |
| Cache                                       | Customer, resource/source versions, permission-sharing rule, current access, freshness                                                                          | South receives North's AP-1; one North role receives another role's restricted answer |
| Queued job                                  | Trusted link to the initiating person or service, customer, purpose, records, and recipient; current permission checked when work resumes                       | Alice's membership is revoked while waiting                                           |
| Child job or tool                           | Permission record the receiving service can verify for this worker and lookup; no broader customer data, actions, budget, or expiry than the parent job permits | Customer permission is missing, forged, changed, expired, or revoked                  |
| Return, saved artifact, citation, or export | Current access of the intended recipient and the customer to which the saved result belongs                                                                     | Wrong-customer content, file, or revealing error is returned                          |
| Logs and support                            | Keep only the permitted details needed for investigation and restrict investigators to the relevant customer's records they may see                             | General dashboard exposes another customer's evidence                                 |

## Proposed checks

| Test                                                                     | Required result                                                                                  | Observed evidence |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ | ----------------- |
| North fills cache; South asks for AP-1                                   | No North content, citation, file, or revealing error reaches South                               | Not run           |
| Restricted North role hits a cache entry created by a broader North role | Unauthorized content is denied despite a matching customer ID                                    | Not run           |
| Revoke Alice's membership before her delegated job resumes               | No further unauthorized read/disclosure; permitted operator gets a minimized blocked-work record | Not run           |
| Child job loses or changes customer scope                                | Receiving service denies it before customer-record access or disclosure                          | Not run           |
| Source restriction/deletion changes after caching                        | Entry is invalidated or refused under the agreed source-age and access-change rules              | Not run           |

Someone still needs to confirm the identity and membership source, which readers may share cache entries, how quickly removed access and invalidated entries stop being served, and who may investigate blocked work. Test storage, credentials, tools, workers, exports, and telemetry too. Removing membership cannot make previously disclosed material unseen; use the approved retention and incident processes for existing copies.

## Blank trace

### Start with these questions

1. Which trusted system confirms the requester's customer membership and current permissions?
2. Can a cache entry or saved job expose material that the next reader may not see?
3. What happens if permission is removed while the work waits?
4. Who may receive the answer, saved file, citation, error, or support record?

### Follow the verified scope

- Which customer/tenant is involved, and which system verifies identity and membership?
- Who starts the work: a person, or an unattended service with its own separate current permission?
- Which current membership, role, resource, purpose, and policy authorize it?
- Who are the intended recipients, and which fields may each see?
- What is the cache key, and which readers are allowed to share its contents?
- Which source versions, current-access check, and rules for refusing old entries apply to the cache?
- What does the saved queued-job record retain, and which permissions are checked when work resumes?
- For a child worker, which verified record names the worker, task, customer, allowed reads/actions, budget, and expiry?
- For each answer, file, or export, which customer does it belong to, who may receive it, and what current-access check runs before return?
- Which credential and storage settings apply, and which tests show customers remain separate?
- Who may inspect logs and support records, under which retention and deletion rules? Who owns a disclosure incident?
- How quickly must removed access stop further reads and disclosure? What was measured, or is that still unknown?

| Boundary                | Where scope is verified | Wrong-scope/revocation test | Actual result | Owner/next action |
| ----------------------- | ----------------------- | --------------------------- | ------------- | ----------------- |
| Request and source      |                         |                             | Not run       |                   |
| Cache and search        |                         |                             | Not run       |                   |
| Queue and resume        |                         |                             | Not run       |                   |
| Child job/tool          |                         |                             | Not run       |                   |
| Answer, file, or export |                         |                             | Not run       |                   |
| Logs and support        |                         |                             | Not run       |                   |

Keep affected work stopped when required authority cannot be confirmed. A tenant label, system prompt, or database filter alone does not establish end-to-end isolation.