Tenant Fence
Trace an access decision through a synthetic role check and workspace boundary.
TryStart at Admin export · cross. Turn off workspace scope to see four synthetic rows cross into another workspace.
Watch forIn the starting scenario, the role check passes but workspace scope blocks all four synthetic records in the other workspace.
The linked story describes related work; the scenarios and results here are synthetic.
Interactive model
Skill practicedCheck authorization and tenant isolation boundaries
Connection to my workNeuralEye documents tenant isolation; this exercise separates role checks from workspace scope without reproducing its authorization path.
Understand the result
Four synthetic requests pass through two separate checks: whether the chosen role may perform an action, and whether the request is scoped to its active workspace. Disable workspace scoping to see an otherwise-authorized cross-workspace request return sample rows. The roles, records, and policy here are teaching examples; this is not a NeuralEye implementation or a production security test.
Controls
- Request scenario
- Choose a synthetic role, action, and workspace pair to inspect.
- Enforce workspace scope
- Adds the active-workspace boundary as a separate check after role authorization.
What to watch for
- In the starting scenario, the role check passes but workspace scope blocks all four synthetic records in the other workspace.
- With workspace scope disabled, all four sample rows return and the result warns that a role-only rule crosses workspace boundaries.
- Choose “Reader export · own”. It stays in its own workspace, yet the separate role check still denies export.
Why it happens
A role answers what an actor can do; it does not, by itself, identify which tenant’s records the actor may reach. This model applies both predicates and returns rows only when both checks pass. Real authorization also depends on trusted identity, server-side enforcement, data access paths, and tests that are outside this small example.
How this idea relates to the linked work
NeuralEye’s project story documents multi-tenant isolation and tenant-safe analytics. This synthetic design exercise makes the separation of actor permissions from workspace scope inspectable; it is not a reproduction of NeuralEye’s authorization path.
See the broader engineering brief