Tenant isolation
Tenant isolation is the separation of tenants’ data, resources, and access in a shared system to prevent unauthorized access or interference between tenants.
Software Security for Developers
Tenant isolation is the separation of each tenant's identity data, configuration, security policies, sessions, and access boundaries from those of other tenants.
- How it is used
- Separates tenant identity, authentication, authorization, configuration, and sessions in multitenant OIDC deployments.
- How deep it goes
- Explains claims, endpoints, roles, branding, registration, and sessions, but does not detail underlying protocol internals.
- Examples
- Uses separate authorization endpoints, a tenant_id claim, tenant-specific roles and permissions, and cross-tenant logout scenarios.
- What you can do after
- Operate/configure tenant-aware OIDC flows with separate claims, endpoints, authorization policies, and sessions.
Read how Software Security for Developers explains tenant isolation →
Authorization in Action
Tenant isolation is the separation of each customer's data, resources, and operations from those of other customers in a shared system.
- How it is used
- Secures shared cloud services by making tenant identity, resource scope, and policy enforceable across services.
- How deep it goes
- Explains tenant identifiers, namespaces, policies, identity, audit records, and layered enforcement without specifying low-level implementation internals.
- Examples
- Uses project_id checks, globally unique tenant_id values, tenant namespaces, scoped audit records, and layered PEP/PDP enforcement.
- What you can do after
- Operate/configure multi-tenant authorization with explicit scopes, centralized decisions, layered enforcement, and tenant-specific policy customization.
Read how Authorization in Action explains tenant isolation →
Related concepts
- Google Cloudproduced by · Google Cloud is Google's public cloud computing platform, providing infrastructure, platform, and managed services for building and operating applications.
- Azureproduced by · Azure is Microsoft's public cloud computing platform, providing on-demand infrastructure, application hosting, and managed services.
- metadata filtercontrasts with · A metadata filter is a condition that selects or excludes records or search results according to attributes associated with them.
- namespacecontrasts with · A namespace is a naming context or identifier space in which names are defined and resolved, distinguishing them from names in other contexts.
- table-level multitenancyimplemented by · Table-level multitenancy is a database design in which multiple tenants’ records share tables and are distinguished by tenant-specific columns and query constraints.
- authorizationuses · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.