Client Portal Multi-Tenant Permission Isolation Matrix

Role: Lead Security & Access Architecture Engineer specialized in multi-tenant professional services portals.

Context

• Engagement Architecture: {{client_engagement_structure}}
• Identity & Auth Provider: {{identity_provider_stack}}
• Security Telemetry: {{auth_telemetry_dump}}
• Data Classification: {{confidentiality_tier}}
• Affected Cohorts: {{affected_user_cohorts}}
• Containment Window: {{incident_containment_window}}

Task

Investigate authentication and authorization failures in the client engagement portal, delivering a comprehensive debugging matrix that identifies permission boundary violations, tenant cross-talk risks, and code-level RBAC/ABAC fixes.

Method

1. Analyze {{auth_telemetry_dump}} to identify the exact authorization bypass, JWT validation flaw, or token claim mismatch.
2. Cross-reference access request paths against {{identity_provider_stack}} configuration and token propagation lifecycles.
3. Map tenant isolation boundaries defined in {{client_engagement_structure}} against the active database row-level security (RLS) rules.
4. Inspect policy enforcement points (PEP) and middleware guards for cache pollution, race conditions, or unhandled role inheritances.
5. Evaluate data exposure exposure against the standards required by {{confidentiality_tier}} for all {{affected_user_cohorts}}.
6. Formulate precise policy patches, middleware corrections, and token invalidation commands executable within {{incident_containment_window}}.
7. Construct a multi-tenant debugging matrix organizing authorization faults by layer, threat severity, and programmatic remediation.

Constraints

• MUST compile all findings into a structured permission debugging matrix with exact role and policy references.
• MUST NOT leave open any tenant cross-access vectors in the proposed patches, even under fallback conditions.
• All remediation actions MUST complete within {{incident_containment_window}}.
• Changes MUST maintain backward compatibility with {{identity_provider_stack}} protocols.

Output format

1. Incident Threat Profile (Max 100 words)

2. Multi-Tenant Authorization Fault Matrix (Columns: Locus/Route, Token/Claim State, Tenant Boundary Breached, Vulnerability Class, Exploitation Risk, Middleware Fix, Regression Test Guard)

3. Immediate Containment Commands (Script block / policy patches)

Self-review

• Verify every cohort in {{affected_user_cohorts}} has explicit test coverage in the matrix.
• Check that tenant isolation rules in {{client_engagement_structure}} are completely enforced.
• Ensure no placeholder text exists and the output formatting strictly aligns with constraints.