Skip to content

Topic

Authorization and permissions

Deciding what an authenticated caller may do, including role and permission models, privilege ceilings, and where those checks are enforced.

Current clusters

build1 publisher

A flat tenant_id forces the three workarounds that ship cross-tenant leaks

A checklist written by someone who sells generated multi-tenant backends dates the tenant model and the source of tenant identity to day one, and the database isolation argument to the first paying customer. The author then runs the test on their own product.

Publishers:dev.to

Reality

Evidence42
Adoption
Insufficient
Hype gap−10
Incentives70
Confidence52