Design 01 - Secure Multi-Tenant SaaS
Prompt
Design security for a global SaaS product storing regulated customer documents. It supports browser, API, SCIM, enterprise SSO, background processing, customer-managed keys, and third-party webhooks.
Requirements to Clarify
Tenant count and size, data classes/residency, sharing model, administrator roles, RPO/RTO, support access, key ownership, integrations, export/deletion, and compliance evidence.
Architecture
- Federated user identity with strong account recovery and step-up authentication.
- Workload identity for every service; no shared static service credentials.
- Central relationship/attribute-aware authorization with tenant context mandatory at the data access layer.
- Separate control plane and data plane; scoped asynchronous job identity.
- Envelope encryption with tenant context, rotation, audited key use, and honest CMK limitations.
- Signed webhooks, replay protection, egress controls, and per-tenant secrets.
- Central audit trail for admin, data, policy, key, export, support, and integration actions.
Top Abuse Cases
- Cross-tenant object or search access.
- Compromised support/admin identity.
- Background worker processes another tenant's object.
- Webhook SSRF or secret replay.
- Export/deletion bypass, stale replicas, or backup retention mismatch.
- CI/supply-chain compromise modifies authorization.
Control and Validation Plan
- Property-based tenant-isolation and authorization matrix tests.
- Per-tenant quotas and abuse controls.
- Just-in-time, approved, recorded support access.
- Database constraints/partitioning where useful; application policy remains explicit.
- Policy changes reviewed like code and observed in decision logs.
- Canary tenant identifiers in logs/evals to detect leakage.
- Restore, key rotation, incident, and tenant offboarding exercises.
Tradeoffs
Database-per-tenant improves some isolation and operations become expensive. Shared tables scale efficiently but demand pervasive tenant invariants. Customer-managed keys improve control but do not automatically prevent plaintext processing by the service.
Residual Risk
Privileged control-plane compromise, unknown authorization variants, insider/support access, and shared infrastructure remain. Explain ownership, telemetry, and recovery for each.