Tenant isolation in CDMS

The two operating modes of data storage: one database for everyone or one per tenant. What changes as a result.

The tenant is in the token. This page explains how it is read and what happens without a tenant.

The decision whether an access lands in the system DB or in the tenant DB, as a complete decision table. Without a fallback to the system DB.

How an authorized person works for another tenant with the tenant header, and why a switch without the role is silently ignored.

How an authorized person works on behalf of another person, with their own roles or with those of the target person, and which checks come first.

Before every access the filter chain asks CIAS whether the tenant is active. This page gives the CDMS view; the details are in the CIAS section.

Every tenant has its own database with its own connection pool. When it is created and how its schema is migrated.

The security invariants of tenant isolation: no fallback to the system DB, separate type sets, only three places may set a tenant.