Tenant Isolation

Tenants are isolated customer or subscription contexts. Product code must preserve this boundary in reads, writes, administration, and support operations.

Implementation Facts

• DomainEntityInterceptor populates TenantId.
• TenantId comes from IServiceContext.UserInfo.SubscriptionId.
• Repository list and get queries must filter by tenant.
• API keys, templates, documents, users, and audit records should be treated as tenant-scoped.

Review Checklist

1. Confirm every list query filters by TenantId.
2. Confirm every get-by-id query verifies tenant ownership.
3. Confirm cross-tenant administration is explicit and permissioned.
4. Confirm support logs do not expose data from another tenant.

Related Docs

• Data Model
• Tenant Management
• Audit And Soft Delete