Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
GS17 · Tenant, role and file-ID isolation
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software (new in the GGA baseline) |
| Source | Blueprint pp. 3, 12, 13, 14, 15, 17 (GGA-Requirement-Register); client-supplied draft, not accepted |
| Gate | GA09 |
| Blueprint delivery stage | Stage 2 Foundation and publishing (p. 19) |
| Build step | 03 (primary; tests first) |
| Replaces or carries | DG22, T02, T04, T10, T25, T26, T27, T28, T32 |
| Decisions | GQ03-staged |
Given
Three synthetic companies with canary data in every owned record and file, an approved partner, operations, finance and technical roles.
When
Change a company ID, record ID and file ID in requests; call every route as every role; ask for an absent object and a forbidden object; revoke or downgrade a role mid-session; read as finance; try to record a settlement as a non-finance user; run row-level-security tests with the real application role.
Then / oracle
Nothing of another organisation is exposed. Denials do not reveal whether a private object exists (404 where existence must stay private; 403 for prohibited actions). Finance cannot read capability files; non-finance users cannot record a settlement. Role and company changes take effect on the next request. Database policies hold when exercised with the actual application role; application checks remain in place.
Evidence required
Matrix of role by route by company; identical bodies for absent and forbidden objects; database policy test output.
Decision dependency
- GQ03-staged: The company-internal role set beyond owner and invited colleague is open
Where a decision is pending, the dependent assertion is Blocked by that decision and no oracle is invented. A proposed default is a configuration value, not a promise. This note is a specification: it is Passed only on a named integrated build and fixture.
Back to GGA-Scenario-Index · GGA-Traceability-Matrix · Scenario-Dispositions.