UNDERSTAND THE CONCEPT
A tenant represents an organization’s boundary within a shared service. Isolation needs to cover records, attachments, search results, exports, background jobs and connected services. Separating screen navigation alone does not establish that boundary.
Define how tenant context is established and enforced, and test attempts to access another tenant’s identifiers. Administrative and support workflows also need scoped access and auditable actions. Module entitlement and data permission are related controls with different purposes.
Questions to take back to your team
- Is tenant scope enforced for every data path?
- Do exports and background jobs preserve the boundary?
- How is exceptional support access approved and recorded?
Further reading
Explore the primary references below. Requirements and applicability depend on your organization and jurisdiction.
