Tenant isolation
Review the administrative escape hatch
Privileged tools often bypass the normal tenant context. Inspect their authority, target selection and audit trail as carefully as the customer-facing API.
In this article
Identify every privileged route
List support consoles, database scripts, bulk exports, replay tools and service identities that can cross tenant boundaries. Include emergency access that is rarely used.
For each route, state its purpose and who may invoke it. A shared administrator credential makes it difficult to attribute actions and can expose more data than the task requires.
Check whether an ordinary endpoint can activate privileged behaviour through a parameter or header. Hiding the control in the interface does not protect the server path.
Inspect target selection and confirmation
A support tool should make the tenant and target unmistakable before a consequential action. Similar organisation names or local record identifiers can cause mistakes even when the operator is authorised.
Bind the operation to the selected tenant in server-side state and validate every target. Do not rely on the operator's current browser tab as the only scope control.
For bulk work, show the intended scope and handle mixed-tenant identifiers according to an explicit policy. A convenient global query can turn a one-account repair into a wider mutation.
Review runtime privileges and evidence
Inspect the actual database and storage roles used by the tool. Row-level policies may not apply to privileged identities, so test the route under its real configuration.
Record actor, tenant, operation and result without logging unnecessary payload content. The audit trail should make a cross-tenant action explainable while respecting the sensitivity of the data.
Keep read access and mutation authority distinct. Someone diagnosing an issue may not need the ability to replay jobs or alter records.
Require a wrong-tenant test
Use synthetic tenants and deliberately select a target from the wrong account. Confirm the tool blocks or explicitly handles the operation under its documented privileged contract.
Test a stale selection, concurrent sessions and a revoked operator role. Inspect resulting artifacts as well as the main response.
The review should leave a narrow, owned exception path with evidence. Tenant isolation is not fully assessed until the routes designed to bypass ordinary boundaries have their own dependable controls.
Primary sources
PostgreSQL: row security policiesOWASP: multitenant securityReferences checked 11 September 2026.