Authorization is a data boundary
Multi-tenant authorization fails when tenancy is treated as interface context instead of a property of every protected operation. A tenant selector in the navigation is useful; it is not a security boundary.
The durable model carries tenant identity through authentication, application services, jobs and data access. Every layer should make cross-tenant access difficult by construction and visible when attempted.
Define invariants before permissions
Start with the rules that cannot be violated: every protected record belongs to a tenant, membership is explicit, and privileged support access is both narrow and auditable. Roles and permissions become easier to reason about after these invariants are fixed.
Central policy functions reduce drift, but centralization alone is not enough. Tests should exercise negative paths, background workers and bulk operations—the places where request-level assumptions often disappear.
Operations complete the design
Audit events need actor, tenant, decision and resource context. Alerts should focus on invariant violations rather than ordinary denials. The result is a system that can explain access decisions in production, not only pass a pre-release checklist.