Tenant isolation
Give support a tenant-safe diagnostic path
Operators should be able to locate a failure without gaining unnecessary access to every customer's data. Transfer scoped tools and escalation rules with the application.
In this article
Start diagnostics with identifiers
Provide tenant, request, job and operation identifiers that connect the report to the relevant records. Show status, timing and error category without exposing full payloads by default.
Keep tenant selection explicit in the support interface and server-side query path. A remembered global context can lead an operator to inspect the wrong account after switching tasks.
Document which roles may view content and which may only inspect metadata. Diagnosis and corrective mutation should have separate authority where the workflow requires it.
Transfer the complete data map
Include primary storage, files, exports, caches, search indexes and queued work. Support needs to know where a tenant's data can appear when investigating a report or removal request.
Record the authoritative routing source for tenants placed in different stores. A worker or support tool should not rely on an obsolete location copied into an old job without a defined rule.
Explain any privileged cross-tenant path, its audit requirements and the owner who can approve its use under the organisation's process.
Rehearse an investigation with paired tenants
Give the receiving team a synthetic job failure in tenant A and similar records in tenant B. Ask them to find the correct operation, inspect its permitted evidence and recover it through the supported path.
Check that they cannot accidentally download or mutate tenant B's data through the normal diagnostic flow. Include a queued job and an exported artifact, not only a database row.
Use the exercise to find unclear labels, missing correlation and overbroad access. Fix those gaps before relying on the runbook during a real incident.
Assign boundary maintenance
Name who reviews new jobs, caches and exports for tenant scope. Keep negative isolation tests in the normal release checks and include runtime permission changes.
Document the response process for suspected cross-tenant disclosure or mutation, with engineering responsible for precise evidence and containment. Avoid leaving support to improvise data-sharing decisions in a general chat.
A successful handover makes safe diagnosis the convenient path. The next team can resolve one tenant's issue while preserving the boundaries that protect everyone else.
Primary sources
OWASP: multitenant securityOWASP: logging guidanceReferences checked 11 September 2026.