Following the 2021 OWASP access-control discussion, tenant isolation was a useful subject for a 2022 engineering review. A tenant identifier in every table is only one part of the boundary.
Construct an adversarial fixture
Create two organisations with similar records and different users. Deliberately reuse human-readable values such as invoice numbers so a test cannot accidentally pass because every record has an obviously unique name.
Exercise list, detail, search, attachment and export endpoints. Search and exports deserve special attention because they often use different queries from the interactive detail page.
An authenticated user from organisation A should not obtain organisation B’s data by changing a URL, a request body, a filter or an attachment identifier. Test the behaviour through the public API, not only through a repository method.
Follow asynchronous work
A queued export must retain the correct tenant context after the original HTTP request has ended. Test the resulting file and its download permissions. Include retries: a worker must not fall back to an unrestricted query when context is missing.
Make tenant-isolation cases part of ordinary feature regression. A new reporting endpoint should inherit the same security expectations as the older screens, even if its implementation uses a different storage path.
Reference
OWASP’s 2021 broken-access-control category supplies the security context; the fixture above is a proposed testing pattern.