Multi-tenancy

Review tenant boundaries before implementation

Trace tenant identity through requests, data stores, caches, jobs, and administration, then turn plausible isolation failures into tests.

Design · Developers, AppSec engineers

Secure design patterns: a catalogue for insecure-design (A06)

A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.

Design · AppSec engineers

Prevent shared-cache poisoning and private-response deception

Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.

Design, Maintenance · Developers, Platform engineers and SREs

Keep retrieval inside the user’s data boundary

Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.

Design, Development · Developers, AppSec engineers, Platform engineers and SREs

RAG access control lab: Stop a retriever from returning another tenant’s documents

A search helper sends every matching document to a model and asks the model to respect permissions. Repair filtering before any content reaches the model.