Tenant and application isolation
Check both what a caller may do and which records they may access. VeriProof applies several controls; their combined effect depends on the service, operation, identity, and database role.
Scope layers
| Layer | Boundary |
|---|---|
| Tenant | Organization resolved from the authenticated identity |
| Role and capability | Actions permitted by the effective system or custom role |
| Application | Applications assigned through role, group, ownership, or explicit scope |
| Audit engagement | Assigned applications and dates for the active engagement |
| Database | Service role, grants, query scope, and row policies |
| Presentation | Response fields and links appropriate for the caller |
Privileged paths
Staff, administrative, background, and database operations can require broader access. Document and test each path separately.
A database role that can bypass row policies needs approval, monitoring, and a narrower service boundary.
Validation matrix
Use controlled identities and records in an authorized test environment. Cover:
- an authorized record;
- another application in the same tenant;
- another tenant;
- an inactive or removed user;
- each standard role;
- relevant custom roles and group scope;
- an expired or unassigned audit engagement; and
- direct API access without the portal navigation.
Inspect the returned records and confirm that out-of-scope data is absent. A 200 response with another tenant’s records is an authorization failure.
For write operations, check the stored result too. A denied response must not leave an approval, configuration change, or other protected action behind.
Role preview is a presentation aid. Use a real signed-in identity and backend response for authorization evidence.