Bosskuai Tenant Isolation Security
Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.
Fast Path
- Treat any cross-tenant data exposure as high-severity security incident.
- Check every query, relation, policy, cache key, job, export, webhook, and report for tenant scope.
- Require server-side tenant checks; never trust client-provided tenant_id.
- Add regression tests for same-user/different-tenant and same-tenant/different-role cases.
Default Checks
- Treat any cross-tenant data exposure as high-severity security incident.
- Check every query, relation, policy, cache key, job, export, webhook, and report for tenant scope.
- Require server-side tenant checks; never trust client-provided tenant_id.
- Add regression tests for same-user/different-tenant and same-tenant/different-role cases.
- Review logs and audit trail for exposure window and affected records.
When To Open The Playbook
Open ../../references/playbooks/bosskuai-tenant-isolation-security-playbook.md only when the task needs detailed workflow, implementation examples, or release-grade depth.
Output Quality
- Start with the verdict or action.
- Separate confirmed facts, assumptions, and risks.
- Include exact files, commands, tests, metrics, or rollback triggers when relevant.
- Do not claim legal, security, or cost certainty without evidence.
References
../../references/playbooks/bosskuai-tenant-isolation-security-playbook.md../../references/checklists/tenant-isolation-security-checklist.md
1---2name: bosskuai-tenant-isolation-security3description: Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.4---5
6# Bosskuai Tenant Isolation Security
7
8Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.
9
10## Fast Path
11
121. Treat any cross-tenant data exposure as high-severity security incident.
132. Check every query, relation, policy, cache key, job, export, webhook, and report for tenant scope.
143. Require server-side tenant checks; never trust client-provided tenant_id.
154. Add regression tests for same-user/different-tenant and same-tenant/different-role cases.
16
17## Default Checks
18
19- Treat any cross-tenant data exposure as high-severity security incident.
20- Check every query, relation, policy, cache key, job, export, webhook, and report for tenant scope.
21- Require server-side tenant checks; never trust client-provided tenant_id.
22- Add regression tests for same-user/different-tenant and same-tenant/different-role cases.
23- Review logs and audit trail for exposure window and affected records.
24
25## When To Open The Playbook
26
27Open `../../references/playbooks/bosskuai-tenant-isolation-security-playbook.md` only when the task needs detailed workflow, implementation examples, or release-grade depth.
28
29## Output Quality
30
31- Start with the verdict or action.
32- Separate confirmed facts, assumptions, and risks.
33- Include exact files, commands, tests, metrics, or rollback triggers when relevant.
34- Do not claim legal, security, or cost certainty without evidence.
35
36## References
37
38- `../../references/playbooks/bosskuai-tenant-isolation-security-playbook.md`
39- `../../references/checklists/tenant-isolation-security-checklist.md`
aibot88