[{"data":1,"prerenderedAt":23},["ShallowReactive",2],{"blog-article-identity-tenancy-and-authorization-from-the-first-commit":3},{"id":4,"slug":5,"body":6,"html":7,"title":8,"description":9,"category":10,"tags":11,"author":16,"date":17,"year":18,"month":19,"quarter":20,"status":21,"featured":22},"2026\u002F07\u002Ffactory-and-architecture\u002Fidentity-tenancy-and-authorization-from-the-first-commit","identity-tenancy-and-authorization-from-the-first-commit","\nAsk what usually delays an AI application's go-live and the answer is rarely the AI. It's the security review. Specifically, the discovery that identity was bolted on, authorization checks are scattered through the code, and tenant isolation depends on every developer remembering a `where` clause.\n\nIn our factory, these three concerns are part of the architecture from the first commit. They're generated into the core of every application foundation.\n\n## Identity\n\nEvery foundation authenticates against an **enterprise identity provider** from day one: OpenID Connect or SAML to Entra ID, Okta, Ping, government SSO or a national identity platform. Local development uses the same flows with a local provider. There's no “temporary” username and password table waiting to be removed.\n\nService-to-service calls use their own identities, and AI agents act either as a service identity or on behalf of the invoking user, never with ambient superuser rights.\n\n## Authorization\n\nAuthorization is **explicit and central**:\n\n- Roles map to permissions in one place.\n- Permissions are checked in the application services layer, not in route handlers or UI code. Every entry point gets the same checks: the API, background jobs, agents and imports.\n- Consequential actions can require a second approver (maker\u002Fchecker) as a declared policy, not ad-hoc code.\n- Principals are re-evaluated per request, so a disabled user or a changed role takes effect immediately.\n\nThis is what makes a security review short. Reviewers read one policy map instead of hunting through handlers.\n\n## Multi-tenancy\n\nMany applications serve several tenants: business units, subsidiaries, government entities, partners, or customers of an SI. The foundations treat the **tenant as a first-class part of the data model**:\n\n- Tenant-owned records are stored and queried within the tenant's partition.\n- The tenant is taken from the authenticated principal, never from request data. A forged tenant ID in a payload is ignored.\n- Cross-tenant requests return “not found” rather than “forbidden”, so they don't leak existence.\n- Cross-tenant views, where legitimately needed, are separate and permissioned paths.\n\nIsolation is tested automatically: cross-tenant reads and writes are part of every foundation's test suite.\n\n## Why generate it instead of documenting it\n\nA guideline that says “always check the tenant” is followed until the deadline. A generated core that makes the unsafe path hard is followed every time. Because the same patterns run across the whole inventory, a weakness found in one place gets fixed in the factory and flows into every foundation that follows.\n\n## What still happens per customer\n\nThe integration with the customer's identity provider and directory, their role model and approval policies, their tenancy boundaries, and their security review. The rails are fixed, and the configuration is the customer's.\n\nMore on the rails: [Architecture](\u002Ffactory\u002Farchitecture) · [AI accelerates, architecture governs](\u002Fblog\u002Fai-accelerates-architecture-governs)\n","\u003Cp>Ask what usually delays an AI application's go-live and the answer is rarely the AI. It's the security review. Specifically, the discovery that identity was bolted on, authorization checks are scattered through the code, and tenant isolation depends on every developer remembering a \u003Ccode>where\u003C\u002Fcode> clause.\u003C\u002Fp>\n\u003Cp>In our factory, these three concerns are part of the architecture from the first commit. They're generated into the core of every application foundation.\u003C\u002Fp>\n\u003Ch2>Identity\u003C\u002Fh2>\n\u003Cp>Every foundation authenticates against an \u003Cstrong>enterprise identity provider\u003C\u002Fstrong> from day one: OpenID Connect or SAML to Entra ID, Okta, Ping, government SSO or a national identity platform. Local development uses the same flows with a local provider. There's no “temporary” username and password table waiting to be removed.\u003C\u002Fp>\n\u003Cp>Service-to-service calls use their own identities, and AI agents act either as a service identity or on behalf of the invoking user, never with ambient superuser rights.\u003C\u002Fp>\n\u003Ch2>Authorization\u003C\u002Fh2>\n\u003Cp>Authorization is \u003Cstrong>explicit and central\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Roles map to permissions in one place.\u003C\u002Fli>\n\u003Cli>Permissions are checked in the application services layer, not in route handlers or UI code. Every entry point gets the same checks: the API, background jobs, agents and imports.\u003C\u002Fli>\n\u003Cli>Consequential actions can require a second approver (maker\u002Fchecker) as a declared policy, not ad-hoc code.\u003C\u002Fli>\n\u003Cli>Principals are re-evaluated per request, so a disabled user or a changed role takes effect immediately.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>This is what makes a security review short. Reviewers read one policy map instead of hunting through handlers.\u003C\u002Fp>\n\u003Ch2>Multi-tenancy\u003C\u002Fh2>\n\u003Cp>Many applications serve several tenants: business units, subsidiaries, government entities, partners, or customers of an SI. The foundations treat the \u003Cstrong>tenant as a first-class part of the data model\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Tenant-owned records are stored and queried within the tenant's partition.\u003C\u002Fli>\n\u003Cli>The tenant is taken from the authenticated principal, never from request data. A forged tenant ID in a payload is ignored.\u003C\u002Fli>\n\u003Cli>Cross-tenant requests return “not found” rather than “forbidden”, so they don't leak existence.\u003C\u002Fli>\n\u003Cli>Cross-tenant views, where legitimately needed, are separate and permissioned paths.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Isolation is tested automatically: cross-tenant reads and writes are part of every foundation's test suite.\u003C\u002Fp>\n\u003Ch2>Why generate it instead of documenting it\u003C\u002Fh2>\n\u003Cp>A guideline that says “always check the tenant” is followed until the deadline. A generated core that makes the unsafe path hard is followed every time. Because the same patterns run across the whole inventory, a weakness found in one place gets fixed in the factory and flows into every foundation that follows.\u003C\u002Fp>\n\u003Ch2>What still happens per customer\u003C\u002Fh2>\n\u003Cp>The integration with the customer's identity provider and directory, their role model and approval policies, their tenancy boundaries, and their security review. The rails are fixed, and the configuration is the customer's.\u003C\u002Fp>\n\u003Cp>More on the rails: \u003Ca href=\"\u002Ffactory\u002Farchitecture\">Architecture\u003C\u002Fa> · \u003Ca href=\"\u002Fblog\u002Fai-accelerates-architecture-governs\">AI accelerates, architecture governs\u003C\u002Fa>\u003C\u002Fp>\n","Identity, tenancy and authorization from the first commit","Why identity, multi-tenancy and authorization are generated into the core of every fazeZERO application foundation instead of added before go-live.","factory-and-architecture",[12,13,14,15],"identity","architecture","application-factory","api-first","fazezero-editorial","2026-07-29T00:00:00.000Z",2026,7,3,"published",false,1790080511874]