Employee Tenant Context Troubleshooting
Summary
Tenant resolution, query filtering, monolith access scoping, and gateway-forwarded context.
Audience
- HR administrators, support engineers, developers, QA engineers, and DevOps engineers
Symptoms
Missing-tenant validation, empty/incorrect tenant results, bad request, forbidden access, or not-found across tenants.
Scope
Tenant resolution, query filtering, monolith access scoping, and gateway-forwarded context.
Cause
Likely causes
- Authenticated identity lacks usable tenant context
- Tenant header/claim propagation does not match the target service
- Cross-tenant identifier was supplied
- Super-admin and client-portal session types were mixed
Safe diagnostic steps
- Confirm tenant portal/session category without exposing claims or tokens
- Record route source and compare same-tenant versus approved cross-tenant negative test
- Use correlation evidence to trace gateway and Employee Service handling
Resolution
Safe resolution
- Re-establish the correct tenant session through approved authentication
- Escalate propagation/filter issues to identity, gateway, and Employee owners
- Do not bypass tenant filters or modify records
Validation
Same-tenant requests return only accessible records; approved cross-tenant tests remain isolated.
Evidence to collect
Sanitized tenant identifier, route source, status, correlation identifier, and test identity category.
Escalation
Identity/gateway owners for context propagation; Employee/database owners for filter behavior; security for suspected exposure.
Related docs
Source References
microservices/src/employee-service/Infrastructure/Persistence.csmicroservices/src/employee-service/Application/Validators/EmployeeCommandValidators.csControllers/LaborController.csscripts/verify-hr-suite.ps1
Related Articles
See Also
Keywords
- Employee troubleshooting
- Tenant Context
- safe diagnostics
Revision Information
- Status: Draft
- Last reviewed: 2026-07-15
- Review cycle: Quarterly