# Multi-tenant authorization

## Product responsibility

Before run, continue, cancel, preview, or download, derive the current user and tenant from your product's trusted session. Do not trust browser-submitted org, tenant, member, Workspace, harness, session, response, or file identifiers.

## Records to keep

- `user_id` or tenant principal.
- `feature_key` and allowlisted `harness_id`.
- `session_id` and `response_id` returned by HarnessRouter.
- Returned `file_id`, path, media type, and product-visible artifact state.

## Checks

- List only sessions belonging to the current product user or tenant.
- Continue only sessions mapped to the current user or tenant.
- Cancel only sessions mapped to the current user or tenant.
- Preview and download only files mapped to an authorized session.
- Return a product-level denial when ownership cannot be proven.

## Product authorization gate

Make the ownership check before every server-side HarnessRouter call that touches an existing session, response, or file. Return a product-level denial when the mapping is missing.

## Open standard

Your ownership checks before continue, cancel, preview, and download extend UHP's requirement that scope be enforced on every operation — the spec counts cancel, delete, continue, and download all as object access. See [object scope in UHP's Security chapter](https://unifiedharnessprotocol.org/spec/security).