Leave Tenant Context

Summary

Tenant context is ambient to requests and drives command requirements plus global query filters; consumers apply tenant identity from event envelopes.

Audience

Backend developers, architects, QA, security, and support engineers.

Overview

The tenant abstraction exposes tenant identity, privileged-context indication, actor identity, and employee/user references. Request context is resolved from authenticated identity and trusted gateway context. Commands fail conceptually when required tenant identity is absent.

EF global filters scope Leave aggregates, configuration, profiles, timeline, and audit records. A privileged context can bypass filters where explicitly represented, so authorization and trusted identity remain separate responsibilities. The Employee consumer uses event tenant identity and intentionally bypasses ambient query filters to find the correct tenant projection.

Global filters reduce accidental cross-tenant reads but do not constitute universal assurance. Every external caller, consumer, repository operation, privileged path, and write must preserve tenant identity and least privilege.

Source References

• microservices/src/leave-service/Application/Common/Abstractions.cs
• microservices/src/leave-service/Infrastructure/Persistence.cs
• microservices/src/leave-service/Infrastructure/LeaveDbContext.cs
• microservices/src/leave-service/Messaging/EmployeeProfileConsumer.cs

Related Articles

• Technical overview
• Known limitations

See Also

• Leave business documentation
• Leave overview

Keywords

• Leave Service
• Leave Tenant Context
• Technical architecture

Revision Information

• Status: Draft
• Last reviewed: 2026-07-15
• Review cycle: Quarterly