SaaS Tenant Isolation Test Matrix: 18 Authorization Cases With Evidence ======================================================================== Source: https://getceron.com/blog/saas-tenant-isolation-test-matrix Published: 2026-10-31T11:37:48-07:00 Updated: 2026-11-05T12:56:59-07:00 Original worksheet and cases: Ceron, 2026. Licensed under CC BY 4.0. https://creativecommons.org/licenses/by/4.0/ Attribute Ceron, link to the resource, and identify changes. Third-party standards and Ceron branding are excluded. Illustrative cases; no customer findings. Run only within your written authorization and agreed scope. FIXTURE PLAN Written authorization / scope reference: Application build and environment: Tenant A: owner / member / read-only user / synthetic record IDs: Tenant B: owner / member / synthetic record IDs: User with valid A and B memberships: Revoked or expired test session: Tenant-scoped API test credentials: Test export worker / file routes / webhook receivers / realtime channels: Approved sharing, bearer-link, and revocation policies: TEST MATRIX TEN-01 · Direct read Positive control: Member A reads an owned synthetic invoice. Negative control: Member A requests tenant B’s invoice using its known test ID. Required observation: No B data or unauthorized metadata is returned. Endpoint / identity / artifact / result: [complete during assessment] TEN-02 · Direct update Positive control: Editor A updates an owned test draft. Negative control: Editor A targets tenant B’s draft with the same request format. Required observation: B’s record and audit history show no unauthorized change. Endpoint / identity / artifact / result: [complete during assessment] TEN-03 · Delete Positive control: Owner A deletes a disposable owned record. Negative control: Owner A targets a disposable record belonging to B. Required observation: B’s record remains and no deletion job is scheduled. Endpoint / identity / artifact / result: [complete during assessment] TEN-04 · List and search Positive control: Member A finds its own synthetic marker. Negative control: Member A searches for a unique marker placed only in B. Required observation: Results, counts, facets, and suggestions reveal no B content. Endpoint / identity / artifact / result: [complete during assessment] TEN-05 · Bulk operations Positive control: Editor A updates two owned test records. Negative control: Editor A submits a mixed list containing one B-owned record. Required observation: The documented partial or atomic policy protects B; no hidden partial update occurs. Endpoint / identity / artifact / result: [complete during assessment] TEN-06 · Tenant selector Positive control: A user selects an organization they belong to. Negative control: The user supplies B’s tenant ID in each accepted selector. Required observation: The server derives or verifies membership before accessing B. Endpoint / identity / artifact / result: [complete during assessment] TEN-07 · Fields and roles Positive control: An ordinary member edits a permitted profile field. Negative control: The same member submits an owner role or billing-owner field. Required observation: Privileged fields stay unchanged and the response discloses no protected field. Endpoint / identity / artifact / result: [complete during assessment] TEN-08 · Nested records Positive control: Member A opens a file in an owned project. Negative control: Member A combines an A project ID with a B file ID. Required observation: Both the parent and child relationship are checked. Endpoint / identity / artifact / result: [complete during assessment] TEN-09 · Downloads Positive control: Member A opens an authorized test export. Negative control: Member B attempts the same protected download through each delivery route. Required observation: Access follows the documented file-link model and expiration policy. Endpoint / identity / artifact / result: [complete during assessment] TEN-10 · Export creation Positive control: Member A starts an export for its organization. Negative control: Member A requests an export scoped to B or includes B’s record IDs. Required observation: No B data enters the job, file, notification, or response. Endpoint / identity / artifact / result: [complete during assessment] TEN-11 · Queued permissions Positive control: A permitted member collects a completed export. Negative control: Remove that member’s access between job creation and collection. Required observation: Job execution and delivery honor the documented revocation policy. Endpoint / identity / artifact / result: [complete during assessment] TEN-12 · Invitations Positive control: Owner A invites a synthetic user into A. Negative control: Member A changes an invite’s tenant or role to gain access to B. Required observation: Invitation issuance and acceptance enforce the intended tenant and role. Endpoint / identity / artifact / result: [complete during assessment] TEN-13 · User in two tenants Positive control: A user with memberships in A and B selects each explicitly. Negative control: Remove only B membership, then reuse an old B request. Required observation: A access remains valid while B access is denied. Endpoint / identity / artifact / result: [complete during assessment] TEN-14 · API credentials Positive control: A test integration key reads its permitted A records. Negative control: The A key requests B resources or a disallowed operation. Required observation: Tenant and action restrictions hold independently of the browser session. Endpoint / identity / artifact / result: [complete during assessment] TEN-15 · Webhooks Positive control: A test event reaches A’s approved receiver. Negative control: A user attempts to subscribe to B’s events or redirect B’s delivery. Required observation: No B event body or signing material reaches A’s receiver. Endpoint / identity / artifact / result: [complete during assessment] TEN-16 · Cache separation Positive control: A and B receive their own versions of the same route. Negative control: Fetch A’s response, then request that route as B and anonymously. Required observation: No cached A body is served to another principal. Endpoint / identity / artifact / result: [complete during assessment] TEN-17 · Realtime channels Positive control: Member A subscribes to an owned test project. Negative control: Member A joins B’s channel or keeps a channel after revocation. Required observation: Subscription and ongoing delivery respect the documented access policy. Endpoint / identity / artifact / result: [complete during assessment] TEN-18 · Support access Positive control: An authorized support action produces a visible audit event. Negative control: An ordinary user or expired support session repeats the support action. Required observation: Only the authorized support scope works and its actor is attributable. Endpoint / identity / artifact / result: [complete during assessment] EVIDENCE LOG (copy for each run) Case ID: Date and time with zone: Application build / configuration: Model and tool configuration (if applicable): Actor / role / tenant: Target resource and owner: Expected result: Authorized comparison result: Observed negative-test result: Sanitized request / response artifact: Authorization / retrieval / job artifact: Final record or delivery state: Result: [ ] Passed under tested conditions [ ] Failed [ ] Blocked [ ] Not applicable Reason / limitation: Finding ID and business impact (if failed): Remediation owner and due date: Retest build / date / evidence / result: Do not count Blocked or Not applicable as Passed. Record reasons separately. Keep credentials and real customer data out of this worksheet. SYNTHETIC EXPORT SEQUENCE 1. Member A starts a permitted export of synthetic A records. 2. Remove member A's access before collection. 3. Test job status, notification URL, application download, and storage link. 4. Compare each observation with the documented revocation and link-expiry policy. 5. Confirm a member who retains access can still collect an authorized export. 6. Record exclusions and any remaining bearer-link access explicitly.