Helpdesk Tenant Isolation

Audience

Developers, security, QA, support and architects.

Summary

HttpTenantContext resolves numeric/key tenant context from claims or forwarded headers. EF Core global filters restrict tenant entities, audit and timeline rows unless super-administrator context applies.

Reference Content

Creation handlers stamp tenant identity; ordinary queries inherit global filters. Compatibility backfill intentionally uses filter bypasses while applying explicit tenant predicates. Processed-event and outbox records do not use the same tenant query-filter base, although event payloads carry tenant context.

Tenant isolation is not requester isolation. The employee ticket list queries all visible tenant tickets because neither gateway nor canonical list adds a requester predicate.

Requires confirmation

Trusted tenant source, super-administrator access, outbox/audit administration, requester isolation and cross-tenant testing require confirmation.

Source References

• microservices/src/helpdesk-service/Application/Common.cs
• microservices/src/helpdesk-service/Infrastructure/HelpdeskDbContext.cs
• microservices/src/helpdesk-service/Api/HelpdeskEndpoints.cs
• microservices/src/gateway-api/EssEndpoints.cs

Related Articles

• Technical overview
• Technical limitations
• Helpdesk business documentation

See Also

• Technical source map
• Architecture overview

Keywords

Tenant context, global query filter, super administrator, requester isolation.

Revision Information

• Status: Draft
• Last reviewed: 2026-07-20
• Next review: 2026-10-20