DevelopmentGPT-5ArchitectureRiskDatabase

Multi-Tenant Data Isolation Review

Review tenant boundaries across queries, caches, jobs, and logs to prevent cross-tenant leakage.

Prompt

# Role
You are a senior software engineer and technical lead. Establish evidence and invariants first, then propose the smallest verifiable and reversible implementation.

# Objective
Complete “Multi-Tenant Data Isolation Review”: Review tenant boundaries across queries, caches, jobs, and logs to prevent cross-tenant leakage.

# Required Input
Tenant model, schema, auth context, ORM queries, cache keys, jobs, object storage, logs, and current tests.

If information is missing, ask up to five high-information questions. Otherwise begin directly.

# Execution Protocol
1. Confirm goal, constraints, environment, symptom, and evidence.
2. List invariants, hypotheses, and cheap falsification checks.
3. Compare correctness, complexity, performance, security, migration, and rollback.
4. Provide implementation, test matrix, release gates, and monitoring.

# Required Deliverables
Trust-boundary map; leak paths; query/policy checks; cache/queue audit; adversarial tests; repair priority; monitoring and incident flow.

# Acceptance Criteria
Missing tenant context fails closed; isolation is server-enforced; cache keys and object paths include tenant boundaries; tests cover unauthorized reads/writes.

# Shared Constraints
Never invent facts, data, certifications, reviews, or sources. Label assumptions and verification methods. Put the copy-ready deliverable first and finish with a five-point self-review and corrections.

Curated by the editorial team · Updated 07/23/2026 · Model: GPT-5

Usage guide

How to use this prompt

This template is designed for development tasks. Replace the sample details with real constraints before running it in GPT-5.

Step 1
State the stack, runtime, inputs, outputs, and existing constraints.
Step 2
Ask for the approach and risks before requesting the smallest verifiable change.
Step 3
Run tests, type checks, and critical scenarios locally before merging.

Details to replace or add

Specific inputs produce more useful results. Do not submit passwords, private information, or confidential business data.

Language, framework, and versions
Current code and error output
Expected inputs and outputs
Compatibility and performance constraints
Acceptance test cases

Output checklist

The code runs on the specified versions
Edge cases and errors are handled
Existing project patterns are reused
Tests cover critical behavior
No new security or performance risk appears

Common adjustments

Provide the directory structure and interfaces when the answer drifts from the project.

Limit files and request staged changes when the proposal is too broad.

Ask for runnable test commands and expected output when verification is unclear.

This prompt separates Development, Architecture, Risk, Database requirements into context, constraints, and output format. Keep the objective fixed and revise only the conditions that failed before rewriting the whole template.