# Bosskuai Tenant Isolation Security

> Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.

- Skill: `aibot88/bosskuai-tenant-isolation-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/bosskuai-tenant-isolation-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/bosskuai-tenant-isolation-security/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/bosskuai-tenant-isolation-security

---


# Bosskuai Tenant Isolation Security

Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.

## Fast Path

1. Treat any cross-tenant data exposure as high-severity security incident.
2. Check every query, relation, policy, cache key, job, export, webhook, and report for tenant scope.
3. Require server-side tenant checks; never trust client-provided tenant_id.
4. Add regression tests for same-user/different-tenant and same-tenant/different-role cases.

## Default Checks

- Treat any cross-tenant data exposure as high-severity security incident.
- Check every query, relation, policy, cache key, job, export, webhook, and report for tenant scope.
- Require server-side tenant checks; never trust client-provided tenant_id.
- Add regression tests for same-user/different-tenant and same-tenant/different-role cases.
- Review logs and audit trail for exposure window and affected records.

## When To Open The Playbook

Open `../../references/playbooks/bosskuai-tenant-isolation-security-playbook.md` only when the task needs detailed workflow, implementation examples, or release-grade depth.

## Output Quality

- Start with the verdict or action.
- Separate confirmed facts, assumptions, and risks.
- Include exact files, commands, tests, metrics, or rollback triggers when relevant.
- Do not claim legal, security, or cost certainty without evidence.

## References

- `../../references/playbooks/bosskuai-tenant-isolation-security-playbook.md`
- `../../references/checklists/tenant-isolation-security-checklist.md`