Tenant Zero: AI & SaaS Authz Failures

Overview of the course, learning objective and syllabus

The mental model the entire course builds on. Covers the precise difference between authentication and authorization, why most tenant isolation bugs are authorization problems, and the three multi-tenant architecture models with the security trade-offs each carries into your codebase.

Traces tenant identity through a complete request lifecycle and identifies every point where it is silently dropped -- in helper functions, async workers, task queues, and internal service calls. Introduces the explicit-parameter rule that makes tenant dependencies visible and testable.

The three most common tenant isolation failure classes: IDOR, vertical privilege escalation, and mass assignment. Shows how each appears in AI-generated code, what the exploit looks like, and what correct ownership verification requires.

A multi-tenant document API with four broken endpoints. Exploit a missing tenant ownership check (IDOR), a role-writeable profile update (mass assignment), an unenforced admin endpoint (vertical escalation), and a listing helper that drops tenant context. Fix each vulnerability and make all security tests pass.

How tenant isolation can be enforced at the database layer independently of application code, using PostgreSQL Row-Level Security as the reference. Covers the three bypass patterns that make RLS fail silently in production.

An API backed by PostgreSQL with RLS policies correctly defined but three misconfigurations that bypass them. Demonstrate each bypass then fix the role configuration and query paths.

Compares RBAC, ABAC, and ReBAC and shows where each breaks under SaaS conditions. Introduces OpenFGA for relationship-based authorization, covers authorization modelling with tuples and checks, and explains permission inheritance risks.

Treats API tokens and sessions as authorization surfaces. Covers over-permissioned scopes, missing tenant binding, OAuth audience validation, stale JWT claims, and treating user removal and session invalidation as one atomic operation.

The permission matrix as the primary authorization testing tool. Build a matrix, translate every cell into a test, verify both denials and permissions. The cross-tenant read test is non-negotiable for every resource type.

The same DocStore API extended with three new endpoints. No security tests provided -- you build the permission matrix, write the full test suite, and let failing tests reveal the gaps.

Extends tenant isolation into provisioning race conditions, incomplete deprovisioning, scheduled jobs that lose tenant context, and internal service calls that treat network position as a security boundary.

A SaaS operations API with a provisioning race condition, a deprovisioning flow that leaves API tokens active, and an unauthenticated internal endpoint. Exploit each, then fix with atomic operations and service token validation.

Why RAG pipelines introduce a new tenant isolation failure class, how OpenFGA pre-retrieval filtering closes the retrieval authorization gap, and why prompt injection is most dangerous when unauthorized data is already in the context window.

A multi-tenant AI assistant with no pre-retrieval authorization filter. Demonstrate cross-tenant leakage and prompt injection extraction, then implement OpenFGA filtering at the retrieval layer.