Skip to main content

Workflow Tenant Isolation

Summary​

Tenant isolation uses an ambient ITenantContext and EF Core global query filters. Commands require a positive numeric tenant; reads rely on the filters.

Context resolution​

The HTTP adapter can read tenant, roles, email and user identity from recognized claims or request metadata. It supports limited legacy tenant-key translation. Missing required tenant context raises an exception that middleware translates to a bad request.

Query filters​

Definition/version/step/condition, instance/task/action, audit and timeline entities are tenant-filtered. A super-administrator role bypasses these filters. Processed-event and outbox records do not use the same tenant query filter.

Write behavior​

Aggregate factories and writers receive the resolved numeric tenant. Repository queries are additionally constrained by global filters.

Design-time behavior​

A non-HTTP tenant adapter bypasses filters for migrations and development seeding and cannot satisfy command tenant requirements.

Limitations​

Request metadata is accepted without endpoint authentication. Super-administrator bypass is role-name based. Outbox and processed-event isolation differ from canonical aggregate filtering.

Requires Confirmation​

Trusted-proxy ownership, super-administrator access governance and operational-feed tenant exposure require confirmation.

Source References​

  • microservices/src/workflow-service/Application/Common/Abstractions.cs
  • microservices/src/workflow-service/Infrastructure/Persistence.cs
  • microservices/src/workflow-service/Infrastructure/WorkflowDbContext.cs
  • microservices/src/workflow-service/Program.cs

See Also​

Keywords​

Workflow architecture, approval engine, Workflow Service, technical foundation.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20