Topic starter
18/08/2026 2:16 pm
TL;DR: Multi-tenancy concentrates scale and risk in the same shared application layer: one Tenant ID, one authorization failure, and one cross-customer breach. According to Ory, identity and access management is the enforcement layer that keeps pooled SaaS safe, while OWASP ranks broken access control as the number one web application risk.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “What Is Multi-Tenancy in SaaS Applications”.
Key questions
Q: What breaks when tenant-scoped identity controls are missing in multi-tenant SaaS?
A: Without tenant-scoped identity controls, shared SaaS can let one customer read, change, or administer another customer's data through a valid session that is evaluated in the wrong context.
Q: Why does multi-tenancy make broken access control more dangerous?
A: Multi-tenancy increases the blast radius of broken access control because many customers share the same code paths, storage, and administrative surfaces.
Q: How should security teams enforce tenant boundaries in multi-tenant SaaS?
A: They should require tenant context to travel with every authentication event, API call, and database query, then deny any request that cannot be tied to a known tenant.
Practitioner guidance
- Define tenant context as an invariant Carry Tenant ID through authentication, authorization, API handling, and database access so every decision is evaluated in the same tenant scope.
- Enforce tenant-scoped authorization everywhere Apply fine-grained permissions to users, admins, background jobs, and delegated actions so a valid identity cannot operate outside its tenant boundary.
- Review pooled query paths for missing filters Inspect shared-table and shared-schema implementations for code paths that can read records without a tenant filter or context check.
Bottom line: Multi-tenancy is efficient only when tenant context is enforced as an access-control rule across the full request path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:07 pm
Tenant boundaries are an identity problem before they are a storage problem. Shared infrastructure only becomes dangerous when the enforcement layer cannot keep tenant context attached to every request, permission, and administrative action. That is why multi-tenancy succeeds or fails at the authorization layer, not at the marketing layer. Practitioners should treat tenant-scoped access as a first-class IAM design requirement, not a downstream application detail.
A few things that frame the scale:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: What is the difference between silo, pool, and hybrid multi-tenancy?
A: Silo multi-tenancy gives each tenant dedicated resources, pool multi-tenancy shares the same infrastructure across customers, and hybrid mixes both depending on customer tier or risk requirements. The practical difference is where isolation is enforced and how much of the tenant boundary must be carried by software policy versus physical separation.
👉 Read our full editorial: Multi-tenancy in SaaS depends on tenant-scoped identity controls