Setting the file. One moment.
Skill 10 · Django Access Review
Subchapter 10.4
references/tenant-isolation.mdMarkdown2 KBView on GitHub
Background on multi-tenant architectures. Use this to understand the ownership model you’re investigating.
Most apps have layered ownership:
Organization/Tenant
└── Team (optional)
└── User
└── ResourceKey question: At which level is authorization enforced?
# User's current tenant stored in session/request
request.user.organization
request.user.current_tenant# URL: /orgs/{org_id}/projects/
# Question: Is user verified as member of this org?# Middleware sets tenant context
# Manager auto-filters by current tenant
# All queries implicitly scopedHow is tenant determined?
If from URL, is membership validated?
Are all queries scoped to tenant?
Can user switch context to another tenant?
“Can a user in Organization A access data belonging to Organization B?”
Trace the code to answer this. Check: