Tenant Isolation

Definition:

Tenant Isolation is a security and architecture principle in multi-tenant systems where each customer (tenant) operates in a logically or physically separated environment so that one tenant cannot access, modify, or even detect another tenant’s data, configuration, or traffic. It is the foundational guarantee of any SaaS platform — without it, no customer would trust their data in a shared system.

The concept comes from property leasing: in an apartment building, each unit is isolated by walls, locks, and separate utility meters. You can’t walk into your neighbor’s apartment. You can’t see their bills. You don’t even hear their conversations through properly soundproofed walls. That’s tenant isolation.

The Isolation Spectrum — from cheapest to most secure:

Example:

A simple multi-tenant task management API that demonstrates row-level tenant isolation — and shows what happens when isolation breaks.

from dataclasses import dataclass
from typing import Optional

# ═══════════════════════════════════════════════
#  Data Layer — Shared Database, Row-Level Isolation
# ═══════════════════════════════════════════════

@dataclass
class Task:
    id: int
    tenant_id: str
    title: str
    completed: bool = False

# Simulated database — all tenants share this table
DB: list[Task] = [
    # Tenant "acme-corp"
    Task(1, "acme-corp", "Onboard new employee", True),
    Task(2, "acme-corp", "Renew SSL certificate", False),
    Task(3, "acme-corp", "Q3 budget review", False),
    # Tenant "globex-inc"
    Task(4, "globex-inc", "Deploy v2.0 to production", True),
    Task(5, "globex-inc", "Penetration test report", False),
    Task(6, "globex-inc", "Update PCI compliance docs", False),
    # Tenant "initech"
    Task(7, "initech", "Fix TPS report cover sheet", True),
    Task(8, "initech", "Order new red stapler", False),
]

# ═══════════════════════════════════════════════
#  🐛 INSECURE — Missing Tenant Isolation
# ═══════════════════════════════════════════════

class InsecureTaskService:
    """This service has a tenant isolation bug — no tenant_id filter."""

    def get_task(self, task_id: int) -> Optional[Task]:
        # 🐛 BUG: Only filters by task_id, NOT by tenant_id!
        # If tenant "acme-corp" asks for task_id=6, they get
        # globex-inc's confidential penetration test report.
        for task in DB:
            if task.id == task_id:
                return task
        return None

    def search_tasks(self, query: str) -> list[Task]:
        # 🐛 BUG: Returns tasks from ALL tenants!
        # A search for "deploy" returns results from every company.
        return [t for t in DB if query.lower() in t.title.lower()]

# ═══════════════════════════════════════════════
#  ✅ SECURE — Proper Tenant Isolation
# ═══════════════════════════════════════════════

class SecureTaskService:
    """Every query is scoped to the current tenant."""

    def __init__(self, current_tenant_id: str):
        # Injected at the start of every request (from auth token)
        self.tenant_id = current_tenant_id

    def get_task(self, task_id: int) -> Optional[Task]:
        # ✅ FIX: Filter by BOTH task_id AND tenant_id
        for task in DB:
            if task.id == task_id and task.tenant_id == self.tenant_id:
                return task
        return None

    def search_tasks(self, query: str) -> list[Task]:
        # ✅ FIX: Only return tasks belonging to this tenant
        return [
            t for t in DB
            if self.tenant_id == t.tenant_id
            and query.lower() in t.title.lower()
        ]

    def create_task(self, title: str) -> Task:
        # ✅ FIX: New task is automatically tagged with the tenant
        new_id = max(t.id for t in DB) + 1
        task = Task(id=new_id, tenant_id=self.tenant_id, title=title)
        DB.append(task)
        return task

# ═══════════════════════════════════════════════
#  Demo — Showing the Bug in Action
# ═══════════════════════════════════════════════

print("🐛 INSECURE SERVICE — Tenant Isolation Bug Demo")
print("===============================================\n")

insecure = InsecureTaskService()

# Acme Corp user looks for task ID 6 (which belongs to Globex Inc)
print("🔴 Acme Corp requests: get_task(task_id=6)")
leaked = insecure.get_task(6)
print(f"   → Received: {leaked}")
print(f"   ⚠️  PROBLEM: This task belongs to 'globex-inc', not 'acme-corp'!")
print(f"   ⚠️  Leaked confidential data: '{leaked.title if leaked else 'N/A'}'\n")

# Cross-tenant search leak
print("🔴 Search: search_tasks('deploy')")
leaked_results = insecure.search_tasks("deploy")
for t in leaked_results:
    print(f"   → '{t.title}' (owner: {t.tenant_id})")
print(f"   ⚠️  PROBLEM: 'acme-corp' can see 'globex-inc' tasks!\n")

print(f"\n{'='*60}\n")

print("✅ SECURE SERVICE — Proper Tenant Isolation Demo")
print("=================================================\n")

# Acme Corp logs in — their session has tenant_id = "acme-corp"
acme = SecureTaskService(current_tenant_id="acme-corp")

# Acme asks for task 6
print("🟢 Acme Corp requests: get_task(task_id=6)")
result = acme.get_task(6)
print(f"   → Received: {result}")
print(f"   ✅ Result: None — Acme cannot access Globex's task\n")

# Acme searches only their tasks
print("🟢 Acme Corp searches: search_tasks('budget')")
budget_tasks = acme.search_tasks("budget")
for t in budget_tasks:
    print(f"   → '{t.title}' (owner: {t.tenant_id})")
print(f"   ✅ Only Acme's tasks returned, no cross-tenant leak\n")

# Globex logs in — they get their own data
globex = SecureTaskService(current_tenant_id="globex-inc")

print("🟢 Globex Inc searches: search_tasks('compliance')")
compliance = globex.search_tasks("compliance")
for t in compliance:
    print(f"   → '{t.title}' (owner: {t.tenant_id})")
print(f"   ✅ Only Globex's tasks returned\n")

# Both tenants can create their own tasks without conflict
print("🟢 Acme creates a task, Globex creates a task")
acme.create_task("Prepare for Q4 audit")
globex.create_task("Migrate database to RDS")
print(f"   ✅ Both tasks coexist in the shared database,")
print(f"      tagged with their respective tenant_id\n")

print(f"{'='*60}")
print(f"🏁 KEY LESSON:")
print(f"   A single missing 'WHERE tenant_id = ?' clause turns")
print(f"   a multi-tenant system into a data leak machine.")
print(f"   Every query, every API endpoint, every background job")
print(f"   must enforce tenant scoping — not by convention,")
print(f"   but by architecture (injected tenant context).")

🐛 INSECURE SERVICE — Tenant Isolation Bug Demo
=================================================

🔴 Acme Corp requests: get_task(task_id=6)
 (5/8)
→ Received: Task(id=6, tenant_id='globex-inc', title='Penetration test report', completed=False)
   ⚠️  PROBLEM: This task belongs to 'globex-inc', not 'acme-corp'!
   ⚠️  Leaked confidential data: 'Penetration test report'

🔴 Search: search_tasks('deploy')
   → 'Deploy v2.0 to production' (owner: globex-inc)
   ⚠️  PROBLEM: 'acme-corp' can see 'globex-inc' tasks!

============================================================

✅ SECURE SERVICE — Proper Tenant Isolation Demo
=================================================

🟢 Acme Corp requests: get_task(task_id=6)
   → Received: None
   ✅ Result: None — Acme cannot access Globex's task

🟢 Acme Corp searches: search_tasks('budget')
   → 'Q3 budget review' (owner: acme-corp)
   ✅ Only Acme's tasks returned, no cross-tenant leak

🟢 Globex Inc searches: search_tasks('compliance')
   → 'Update PCI compliance docs' (owner: globex-inc)
   ✅ Only Globex's tasks returned

🟢 Acme creates a task, Globex creates a task
   ✅ Both tasks coexist in the shared database,
      tagged with their respective tenant_id

============================================================
🏁 KEY LESSON:
   A single missing 'WHERE tenant_id = ?' clause turns
   a multi-tenant system into a data leak machine.
   Every query, every API endpoint, every background job
   must enforce tenant scoping — not by convention,
   but by architecture (injected tenant context).