RBAC and ABAC for Multi-Tenant Products: Custom Roles and Tested Rego Policies
When roles are enough, when to add attribute rules, how customers can define roles, and a lab that parses and tests a tenant-aware OPA policy in Rego v1.
Enterprise Security, Identity & Compliance
The controls enterprise security reviews ask about: single sign-on, authorization, sessions, customer-managed keys, and audit logs.
Each guide separates what a control actually guarantees from what it is often assumed to guarantee. That gap is where several labs found problems: a read-then-write token store that let replayed refresh tokens survive, a policy file that did not parse, and an audit-log verifier that never checked its first record. Read them in order if you are preparing for a customer security review; each one ends with the check to run first.
Suggested reading order
-
Enterprise SSO with SAML and OIDC: Validation, Account Linking, and Offboarding
Connect customers' identity providers and link each login to the right account.
-
RBAC and ABAC for Multi-Tenant Products: Custom Roles and Tested Rego Policies
Decide what each user may do, with roles, attribute rules, and policy tests.
Lab finding: The old policy failed to parse as Rego v1 and as v0. The corrected policy passed 7 of 7 tests, including a viewer getting no batch permissions.
-
Session Revocation and Refresh Token Rotation: Where the Design Breaks
End access promptly when a device is lost or an employee leaves.
Lab finding: About 72% of 20,000 trials ended with two live refresh tokens and no alert. An atomic check-and-consume detected reuse in every trial.
-
Customer-Managed Encryption Keys: Envelope Encryption and Real Revocation Time
Encrypt data under a customer's key and know how long revocation really takes.
Lab finding: AES-256-GCM sealed 4 KiB in 0.96 µs and 1 MiB in 0.23 ms on a laptop CPU. With tenant and row IDs as associated data, a copied ciphertext failed authentication.
-
Tamper-Evident Audit Logs: What a Hash Chain Detects and What It Misses
Record sensitive actions so that later edits and deletions are detectable.
Lab finding: A full rehash after an edit and an edit to record 0 both passed a chain-only verifier. A genesis check plus an external checkpoint caught them. Deletions after the last checkpoint passed both.
Put numbers on it: Reproducible Labs
All guides in this topic
Tamper-Evident Audit Logs: What a Hash Chain Detects and What It Misses
A hash chain stored next to the data proves consistency, not integrity. A lab tampers with a 1,000-record chain six ways and shows what external checkpoints add.
Enterprise SSO with SAML and OIDC: Validation, Account Linking, and Offboarding
The SSO bugs that cause incidents happen after the library says 'valid'. How to link logins to users by issuer and subject, map roles, and end access when people leave.
Session Revocation and Refresh Token Rotation: Where the Design Breaks
Short access tokens and rotating refresh tokens only protect you if rotation is atomic. A lab shows a read-then-write store missing about 72% of simultaneous token replays.
Customer-Managed Encryption Keys: Envelope Encryption and Real Revocation Time
How envelope encryption with a customer's KMS key works, how long revocation really takes, and a lab measuring AES-GCM cost and what associated data prevents.