Prove the tenant walls, every deploy.

“Are we sure everything is gated? It would be a huge leak if we cross-contaminate.” Every multi-tenant founder asks this eventually, usually at eleven at night. The correct response is not reassurance. It is an attack.

So we attacked. We registered two hostile accounts on the production system of a two-sided SaaS we are building: an ordinary business owner, and a practice with no relationship to anyone. Then we fired sixteen probes at another tenant's real row IDs, harvested straight from the database: their documents, their financial findings, their exports, their checklist items, plus the operator endpoints for good measure.

What a passing grade looks like

Every probe came back denied, and the way they were denied matters as much as the denial. Role violations answered 403. Missing credentials answered 401. But foreign row IDs answered 404, not 403, and that distinction is load-bearing: a 403 on another tenant's document ID confirms the document exists, and existence is information. Scoped queries that simply cannot see other tenants' rows leak nothing, not even a yes.

A one-night audit only proves that night

The uncomfortable truth about security audits is their expiration date: the next deploy invalidates them. So the probe run did not end as a report. It ended as a test file, checked into CI, that re-registers the hostile accounts and re-fires every probe on every build. Cross-tenant isolation stopped being a property someone verified once and became a property that cannot silently regress, because the deploy that breaks it fails before it ships.

The pattern generalizes

Attack production, not a diagram. Real row IDs, real endpoints, real guards. Threat models are hypotheses; probes are results.

Pin every finding as a test. If proving safety took a probe, keeping it safe requires the probe to run forever. Reports age; suites do not.

Design refusals to say nothing. Audit your error codes like copy. The difference between 403 and 404 on a foreign ID is the difference between a wall and a wall with a window.

The whole exercise, probe design through the permanent suite, took one evening. The founder's eleven-at-night question now has a better answer than “we are pretty sure.” The answer is: the walls were attacked twenty seconds ago, and they held.