Skip to main content

Payroll Tenant Isolation

Summary​

Confirmed EF tenant filters, explicit predicates, and isolation gaps.

Audience​

Payroll developers, QA and support engineers, solution and security architects, and implementation partners.

Purpose​

Document tenant isolation controls visible in source without claiming complete isolation.

Ownership​

PayrollDbContext defines tenant-aware model behavior; each service/query path remains responsible for correct use.

Lifecycle​

Normal queries for 17 tenant entities pass through a global filter. Privileged context can bypass that filter. Numerous service, projection, seeding, and backfill queries call IgnoreQueryFilters and then constrain tenant explicitly.

Persisted fields​

All 19 objects carry tenant metadata. This fact alone does not enforce isolation.

Relationships​

Tenant alignment across logically related records is not protected by composite foreign keys because no foreign keys are configured.

Constraints​

Nine tenant-scoped unique indexes prevent selected cross-record duplicates within a tenant. Outbox event identity is globally unique. Unique indexes do not replace authorization or filtering.

Indexes​

Most query indexes begin with tenant identity. The outbox status/time index does not, reflecting relay-oriented access.

Tenant behavior​

ProcessedIntegrationEvent and OutboxMessage are the two mapped exceptions without global filters. The privileged bypass mechanism exists; its public operational details are intentionally excluded.

Audit behavior​

Audit/timeline records are themselves tenant-filtered. They do not independently detect every cross-tenant access attempt.

Integration usage​

Inbound projection application validates tenant context and uses explicit tenant predicates. Backfill iterates tenants and writes tenant-scoped targets.

Known limitations​

Complete end-to-end isolation cannot be proven from the EF model. No database row-level security or database-per-tenant model is confirmed.

Requires confirmation​

  • Independent database-level tenant controls.
  • Formal review/authorization of every filter-bypass call site.
  • Tenant isolation tests across all API, worker, report, and relay paths.

Source References​

  • microservices/src/payroll-service/Infrastructure/PayrollDbContext.cs
  • microservices/src/payroll-service/Domain/PayrollEntities.cs
  • microservices/src/payroll-service/Infrastructure/Migrations/PayrollDbContextModelSnapshot.cs
  • microservices/src/payroll-service/Application/PayrollCompatService.cs
  • microservices/src/payroll-service/Messaging/PayrollReadModelConsumer.cs

See Also​

Keywords​

  • Payroll database
  • Payroll Tenant Isolation
  • Payroll persistence

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-15
  • Review cycle: Quarterly