Security checklist

• Authenticate the caller and authorize every sensitive action.
• Enforce tenant and resource ownership checks server-side.
• Apply least privilege to users, services, database accounts, and infrastructure roles.
• Encrypt data in transit and at rest where appropriate.
• Store secrets in a managed secret store and rotate them safely.
• Validate input and use parameterized queries or safe database APIs.
• Protect against replay, abuse, injection, insecure direct object references, and resource exhaustion.
• Audit sensitive administrative actions and access to critical data.
• Define data retention, deletion, backup, and recovery policies.

Authentication versus authorization

• Authentication answers: who or what is making the request?
• Authorization answers: is that identity allowed to perform this operation on this resource?

Multi-tenancy models

• Shared database and shared tables: efficient, but tenant isolation must be enforced consistently.
• Separate schemas or databases: stronger isolation boundaries at greater operational cost.
• Dedicated infrastructure: useful for strict isolation or specialized compliance needs, but expensive to operate.

Tenant isolation controls

• Derive tenant identity from a trusted authenticated context, not an arbitrary client-supplied field alone.
• Apply tenant filters consistently in queries and background jobs.
• Scope caches, object-storage paths, events, logs, and search queries by tenant where required.
• Prevent noisy-neighbor resource exhaustion with quotas and rate limits.
• Test cross-tenant access attempts explicitly.

Defense in depth: do not rely on one network boundary or one authorization check. Enforce controls at appropriate layers and monitor suspicious activity.