Architecture Center
Tenant isolation and data boundaries
Explain the isolation guarantees: every record is tenant-scoped, cross-tenant references are refused, and sessions/cookies are host-scoped.
previewsecurityContract >=0.8 <1.0Reviewed 2026-07-20
Problem statement
In multi-tenant software, isolation cannot be left to the interface. A bug on one surface must not expose another tenant's data.
When to use
- You serve multiple tenants and must reason about blast radius.
- A security review needs the isolation model.
When not to use
- Single-tenant deployments with no isolation requirement.
Flow
Request + tenant contextData-layer scope filterPolicy checkTenant-bound resultAudit event
Resource inventory
- Tenant
- The isolation boundary that owns every resource.
- Host-only session
- Cookie scoped to one surface, never Domain=.crescevo.com.
- Audit projection
- Per-tenant, never shared.
Failure modes
- Tenant scope violation
- Cross-tenant references refused at the data layer.
- Unauthorized read
- Policy denies; the attempt is auditable.
Security controls
- Data-layer tenant isolation on every record.
- Host-only cookies; no shared prod/preview secrets.
- Internal services never exposed to the browser (same-origin BFF only).
- Per-tenant audit trail.
Deployment checklist
- Every query scoped by tenant.
- Cookies host-scoped per surface.
- Cross-tenant access tests pass.
- Audit projection isolated per tenant.
Related quickstart: Create your first governed session →