Tenant architecture guide
Client isolation must survive shared physical operations.
A multi-client WMS needs both strong logical ownership and useful shared execution. Filters alone fail when identifiers, joins, exports, integrations, support, automation, billing, or analytics bypass the page.
Isolation layers
Enforce scope at every decision boundary.
User and machine scope
Role, partner, client, warehouse, team, module, session, device, API key, and integration identity.
Scoped commands and queries
Handlers derive or validate tenant context rather than trusting client-supplied ownership fields.
Row-level controls
Database predicates constrain direct identifier access and reduce the impact of a missed application filter.
Audit and export scope
Events, documents, ledgers, support activity, takeout, retention, and deletion retain tenant identity.
Shared floor
Coordinate capacity without blending ownership.
Receive
Identify client, product, ASN, purchase demand, handling unit, ownership, quality, and expected service before put-away.
Store
Apply client-aware location, commingling, lot, serial, expiry, hold, count, and replenishment rules.
Fulfil
Batch and route work across clients only where policy allows; keep allocation, package, label, and order ownership explicit.
Bill
Meter service against the correct client, contract, rate, site, source operation, invoice, and commercial entity.
Adversarial tenant tests
Use valid credentials with the wrong object id.
Read and mutate denial.
Try balances, lots, handling units, holds, counts, reservations, and movement history from another client.
Lifecycle denial.
Try detail, line, allocation, release, cancel, shipment, return, and document paths.
Money-path denial.
Try quote, purchase, wallet, payment method, ledger, label, receipt, void, and refund evidence.
Takeout denial.
Try job, status, manifest, file, and download paths across tenants.
Credential and replay denial.
Try connector config, secret reference, webhook, API key, exchange record, and dead letter.
Audited assistance only.
Try impersonation, scope switch, search, export, and mutation without the required support authority.
Portfolio visibility
Aggregate for operations; constrain the drill-down.
A 3PL supervisor can need workload across clients, while a client user must remain inside one account. Aggregation policy and underlying object access are different decisions.
- Authorized portfolio totals and queues.
- Client-specific inventory, plans, service, and finance.
- Technical identifiers hidden from ordinary business views.
