Skip to content

Tenancy and Permissions

Last verified: 2026-07-26 against dev at f0388abb.

SDP is multitenant. Every assessment and everything derived from it belongs to one organization.

Enforcement Layers

Layer Requirement
Route Endpoints that touch org-scoped data must accept and check organization_id.
Storage Queries must filter by organization_id in the database, not after fetching all rows.
Entity ownership Endpoints operating on an existing assessment/document/batch must verify ownership before returning data.
Frontend Requests include the active organization and discard stale data after org switches.
Tests Route tests use OrgTestClient; direct storage setup passes organization_id.

Backend Pattern

New backend endpoints should:

  1. Accept organization_id as a required query parameter.
  2. Call check_organization_access.
  3. Verify entity ownership through the nearest existing _get_verified_* or _verify_*_org helper.
  4. Filter collection queries by organization in storage.

Frontend Pattern

Frontend service calls use an Axios interceptor to attach the active organization. Components that load data while mounted must handle organization switches by refetching or navigating to a safe page.