# Tenant isolation and authorization

## Scope

- Services and data stores covered:
- Who is a tenant, user, operator and platform admin:
- Current vs proposed claims:

## Trust model

- Authentication identity and token claims:
- Tenant context source and validation:
- Authorization policy decision and enforcement points:
- Privileged bypass path, reason and audit:

## Data access paths

| Path (API, worker, admin, export) | Tenant context source | Enforcement | Negative test |
|---|---|---|---|
| [path] | [source] | [guard / query policy / DB policy] | [test] |

## Isolation edge cases

- Missing, forged or changed tenant ID:
- Cross-tenant foreign keys, joins or search:
- Caches, events, jobs and retries:
- Logging, analytics, exports, backups and deletes:

## Incident handling and validation

- Alerts/audit logs:
- Regression/security tests:
- Known limitations and mitigations: