Authenticated does not mean isolated.

I mocked up a small multi-tenant operations SaaS today: three companies, four roles, and 60 synthetic records. Every route required a valid session. Every role check passed. One export endpoint still returned records belonging to all three companies.

The tenant filter was being applied after aggregation.

More authentication middleware would not have fixed it. The solution was to move tenant identity into the data-access contract:

• tenant_id required by every repository method • database row policies as a second boundary • composite keys that include the tenant • integration tests that deliberately query as the wrong tenant • background exports carrying tenant context from creation through storage

The uncomfortable part was that the UI looked completely correct. Only the exported CSV exposed the failure.

Many SaaS teams test, “Can this user access the endpoint?” Far fewer test, “Can this valid user ever see another customer’s data?”

Which layer do you trust for tenant isolation: application, database, or both?

#SaaSSecurity #BackendEngineering #MultiTenant