intermediate
Threat Model: Multi-Tenant SaaS
Tenant data, admin roles, API keys, integrations, search and AI retrieval.
UserLLMAgentToolDataDecisionHumanGuardrail
Assets
Tenant datahighly-sensitive
Loss of tenant data harms users and the system’s core promise.
API keysconfidential
Loss of api keys harms users and the system’s core promise.
Administrative authorityconfidential
Loss of administrative authority harms users and the system’s core promise.
Actors and capabilities
| Actor | Trust | Starting capability |
|---|---|---|
| Anonymous visitor | untrusted | Can send arbitrary public requests. |
| Authenticated user | semi-trusted | Can exercise product APIs within an account or tenant. |
| Backend service | trusted | Can read and modify scoped production data. |
| Administrator | privileged | Can perform exceptional cross-user operations. |
Entry points & trust boundaries
Attack surface
public Public API and login
Rate-limit, parse and authenticate at the first boundary.
authenticated Product resources
Every object needs a resource-level authorization decision.
privileged Admin operations
Step-up, separate authorization and audit.
public Webhook
Verify exact provider, body freshness and event identity.
Boundary validation
Browser ┃ TRUST ┃ API
origin where relevant · session/token · shape and limits
API ┃ TRUST ┃ Backend
principal · action · resource authorization
Backend ┃ TRUST ┃ Database
restricted role · tenant scope
Threats
A cache, search or retrieval key omits tenant scope.
IMPACT · Compromise of tenant data.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
One API token reaches unrelated tenants or actions.
IMPACT · Compromise of api keys.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
A support action lacks an attributable audit record.
IMPACT · Compromise of administrative authority.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
Residual risk & unknowns
Residual risks
- • Privileged insiders and control-plane compromise remain high-impact.
- • Business abuse can use technically valid operations.
Explicitly out of scope
- • Physical facilities and provider-internal controls.