Designing for Many Tenants

One service stores orders for 4,000 customer companies.

A caller presents a valid token with orders:read and requests an order that belongs to another company. Authentication succeeded. The scope is real. The request must still return no information.

A tenant is one customer organization whose data and policy boundary must remain isolated from every other customer organization.

Tenant context is trusted identity, not ordinary caller input.

1. Tenant Is an Isolation Boundary

A user is a person or program identity