Authorization
Isolate tenants and bulk actions
Carry trusted tenant context through queries, caches, jobs, and batch operations so one organization cannot affect another.
8 minute lesson
Multi-tenant software repeats one authorization boundary everywhere. One missing tenant condition can expose many records at once.
Derive tenant context from trusted membership, not request data alone. Include it in storage queries, cache keys, object paths, queues, and logs. Apply per-object authorization inside bulk operations instead of checking only the first item.
A bulk export may check the first invoice, then load the remaining IDs without tenant filters. A cache key such as invoice:193 can leak the same record even when the database query is correct.
Background jobs must carry immutable tenant context from creation through delivery. Letting a worker reconstruct it from user-controlled job data simply moves the authorization weakness to another process.
Mix valid and foreign invoice IDs in one bulk export. Prove the job, cache, stored file, and download path expose no foreign record, including when the foreign ID appears first.
Lesson completed