Enterprise Identity & Access Management Platform · View 25 of 27 · Assurance

Multi-Tenant Isolation

Three layers, because each one alone has a known bypass.

Editable source SVG draw.io All views

Identity: separate directories, no shared principal. Authorization: tid is a mandatory predicate. Data: partition keys, row-level security and per-tenant containers.
Isolation is proved by storage rather than by code review. A partition key or an RLS predicate holds when a developer forgets a WHERE clause; a coding standard does not.
Dedicated resources are offered for tenants who require them, including customer-managed keys — which give a tenant the ability to revoke access to their own data unilaterally.

Platform operators hold no standing role in any tenant's data plane. Elevation requires PIM plus tenant approval, in the shape of a Lockbox-style workflow.
The platform's own workload identity can manage tenant infrastructure and cannot read tenant data. That separation is enforced by role definition, not by convention.
Every operator action inside a tenant boundary is written to that tenant's own audit trail, so the tenant can see it without asking.

Cross-tenant reporting is the single component with a legitimate reason to read every tenant. It is aggregate-only, has no row export path, and has the tightest review of anything in the platform.
A bug in the shared authorization library would affect every tenant at once. Mitigated by contract tests, fuzzing of the tenant predicate, and a canary tenant in the release path.
Noisy-neighbour effects are handled by per-tenant quotas at the gateway (view 14), which is a performance control rather than an isolation one — do not confuse the two.