Design 01 - Secure Multi-Tenant SaaS

Prompt

Design security for a global SaaS product storing regulated customer documents. It supports browser, API, SCIM, enterprise SSO, background processing, customer-managed keys, and third-party webhooks.

Requirements to Clarify

Tenant count and size, data classes/residency, sharing model, administrator roles, RPO/RTO, support access, key ownership, integrations, export/deletion, and compliance evidence.

Architecture

  • Federated user identity with strong account recovery and step-up authentication.
  • Workload identity for every service; no shared static service credentials.
  • Central relationship/attribute-aware authorization with tenant context mandatory at the data access layer.
  • Separate control plane and data plane; scoped asynchronous job identity.
  • Envelope encryption with tenant context, rotation, audited key use, and honest CMK limitations.
  • Signed webhooks, replay protection, egress controls, and per-tenant secrets.
  • Central audit trail for admin, data, policy, key, export, support, and integration actions.

Top Abuse Cases

  1. Cross-tenant object or search access.
  2. Compromised support/admin identity.
  3. Background worker processes another tenant's object.
  4. Webhook SSRF or secret replay.
  5. Export/deletion bypass, stale replicas, or backup retention mismatch.
  6. CI/supply-chain compromise modifies authorization.

Control and Validation Plan

  • Property-based tenant-isolation and authorization matrix tests.
  • Per-tenant quotas and abuse controls.
  • Just-in-time, approved, recorded support access.
  • Database constraints/partitioning where useful; application policy remains explicit.
  • Policy changes reviewed like code and observed in decision logs.
  • Canary tenant identifiers in logs/evals to detect leakage.
  • Restore, key rotation, incident, and tenant offboarding exercises.

Tradeoffs

Database-per-tenant improves some isolation and operations become expensive. Shared tables scale efficiently but demand pervasive tenant invariants. Customer-managed keys improve control but do not automatically prevent plaintext processing by the service.

Residual Risk

Privileged control-plane compromise, unknown authorization variants, insider/support access, and shared infrastructure remain. Explain ownership, telemetry, and recovery for each.