The failure that ends businesses.
WHY IT IS CATASTROPHIC
It is a breach, it is reportable, and trust does not recover.
WHERE IT HAPPENS
Queries missing the tenant condition Identifiers guessable and unchecked Caches keyed without the tenant Background jobs running without tenant context Search indexes spanning tenants Exports and reports File storage with predictable paths
WHY BACKGROUND JOBS SPECIFICALLY
They run outside a request, so whatever supplies tenant context in a request is absent.
WHAT TO DO
Pass tenant explicitly into every job, and validate it.
WHAT TO ENFORCE AT THE DATA LAYER
A condition applied automatically to every query.
WHAT MECHANISMS EXIST
Row-level security in the database Global scopes in the application framework A repository layer that cannot be bypassed
WHAT TO TEST
Every endpoint, as one tenant requesting another's identifiers.
WHAT TO AUTOMATE
That test, across every resource, run on every change.
WHY AUTOMATE
The surface grows with every feature, and manual checking will lapse.
WHAT TO AVOID
Sequential identifiers exposed publicly Administrative tools without tenant selection Support access without logging
WHAT TO LOG
Every cross-tenant access by staff.
WHAT TO TREAT ANY LEAK AS
A critical incident, with notification obligations.
