Multi-tenant authorization

Product responsibility

Before run, continue, cancel, preview, or download, derive the current user and tenant from your product's trusted session. Do not trust browser-submitted org, tenant, member, Workspace, harness, session, response, or file identifiers.

Records to keep

• user_id or tenant principal.
• feature_key and allowlisted harness_id.
• session_id and response_id returned by HarnessRouter.
• Returned file_id, path, media type, and product-visible artifact state.

Checks

• List only sessions belonging to the current product user or tenant.
• Continue only sessions mapped to the current user or tenant.
• Cancel only sessions mapped to the current user or tenant.
• Preview and download only files mapped to an authorized session.
• Return a product-level denial when ownership cannot be proven.

Product authorization gate

Make the ownership check before every server-side HarnessRouter call that touches an existing session, response, or file. Return a product-level denial when the mapping is missing.

Open standard

Your ownership checks before continue, cancel, preview, and download extend UHP's requirement that scope be enforced on every operation — the spec counts cancel, delete, continue, and download all as object access. See object scope in UHP's Security chapter.