Skip to content

Interview question · Identity, OAuth & Access Control

Design tenant isolation in authorisation for a B2B SaaS product with an AI assistant.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

expertNewPreparation tags: Salesforce, Microsoft, DatabricksUpdated Nov 2026

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 5 follow-ups like an interviewer would

Mina belongs to tenants A and B. Lea belongs to A but cannot read A9. Mina previously cached an answer derived from A9. A queued export may execute after membership changes.

  1. Mina requests B17 while her selected tenant is A. May the service read it?
  2. Lea submits the same query Mina cached inside A. Can the cached answer be returned?
  3. The database query omits its tenant predicate. What does RLS prove?
  4. Mina loses B membership after an export is queued. What should the worker do?
  5. What evidence would let you approve this isolation design?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.