Tenant Boundaries: Questions for Hosted Platform Access

Replace one tenancy label with a component map

Ask what is shared and what is dedicated at each layer: application process, database, schema, queue, storage, network, identity service, backup system and support tooling. Record the isolation mechanism, not just the deployment label. AWS's tenant-isolation guidance explains that isolation approaches vary with architecture and service choices; there is no universal SaaS isolation design.

Include failure domains and capacity controls. Separate databases may still share a host, storage pool or administrator. A resource-intensive export by one customer may affect another unless the design controls it. Describe the risk as a question for evidence and testing rather than assuming that sharing is inherently unsafe or that dedication eliminates every dependency.

Test identity and privileged access boundaries

Determine how each request obtains tenant context and where authorization is enforced. A user-visible tenant selector is not sufficient evidence that the backend prevents access to another tenant's objects. Ask for approved negative tests, privileged-role restrictions and audit records for cross-tenant support access.

OWASP recommends least privilege and authorization checks on requests. Apply that principle to ordinary users, service accounts, support staff and export jobs. Tests must be authorized and use controlled data. Record who can approve emergency access, how long it lasts and how the access is reviewed afterward.

Review recovery, export and change boundaries

Ask whether an individual tenant can be restored or exported without exposing or altering another tenant's data. Clarify whether backups are logically separable, which evidence proves export completeness and which party handles deletion or retention after termination. A readable sample export is useful but does not prove complete history or configuration portability.

Record how shared upgrades are scheduled and communicated. A customer may control its branding while the supplier controls release timing. Link these limits to the service agreement and support process. Revisit the map when a component, subcontractor or deployment model changes; an old architecture diagram is not evidence for a newer arrangement.

Example: a dedicated database with shared dependencies

A fictional hosted service gives each customer a separate database but shares the application workers and reporting queue. The buyer accepts the database separation evidence, then requests queue isolation tests and a tenant-specific restore demonstration. The review does not rename the whole stack dedicated; it records the actual boundaries and outstanding checks.