FDE Foundations · Module 11: Security & Data
Tenant Isolation
Multi-tenant systems isolate by schema, database, or row scoping. Whichever you choose, the data layer must enforce it by default, and the proof is a test suite, not a promise.
10 min reading
Objectives
- Choose the isolation model with the customer
- Enforce tenant scope in the data layer
- Prove isolation with cross-tenant tests
Pick the model deliberately
Shared schema with a tenant column is cheapest and standard; schema-per-tenant and database-per-tenant raise isolation and operational cost. The customer's security review may dictate the answer; otherwise choose by data sensitivity and scale, and write the choice in the brief with its trade-offs.
Enforce in the data layer
Every query is scoped by tenant automatically (row-level security, a query wrapper, or ORM global scopes), so application code cannot forget. The dangerous failure is one missing where clause in one endpoint; defaults in the data layer are the only reliable defense against that mistake.
Tenant context is explicit
The tenant comes from verified identity (token, cert, signed header), never from a parameter a client can choose freely. Background jobs carry the tenant context through queues explicitly; losing context mid-pipeline is how cross-tenant writes happen.
Prove it
A test suite that runs every endpoint twice, as two tenants, and asserts zero visibility across the boundary. Run it in CI on every change. When the customer's security team asks how isolation is guaranteed, the answer is a link to the green suite, which beats any architecture diagram.
Quick check
An optional 2-3 question self-check. Answers never leave your device, are not stored, and never count toward any assessment.
Exercise
Design tenant isolation for a fictional analytics product: chosen model with trade-offs, the enforcement mechanism, how tenant context reaches background jobs, and the test approach.
Pass criteria
Model chosen with a stated reason, enforcement automatic in the data layer, context propagation through queues explicit, and tests assert zero cross-tenant visibility.