SECURITY · ACCESS INSPECTION DESK
Tenant isolation: prevent cross-tenant access
Inspect credential claims, policy gates and the resource decision. Change a condition and follow the exact denial reason.
Scroll the diagram left or right to inspect every label.
Your experiment
Give an admin every scope, then request a resource in the other tenant. In this application policy, tenant separation still denies access.
Prediction is computed immediately; Play reveals each gate in order. A denial prevents every later gate from running. Capture a baseline before changing one field.
Illustrative claims
Decision trace
Offline policy exercise—not a JWT validator, OAuth server or production security boundary. Verification is an injected test result; no cryptography, real tokens, keys or records are used. Never rely on browser controls to enforce real authorization. Roles, gate order and strict same-tenant rules are application-specific assumptions, not universal OAuth requirements. Expiry is evaluated at a fixed instant; animation does not age the token. No revocation, clock skew or delegation is modeled. Bearer token reference · JWT claims reference.
A powerful role remains tenant-local
The policy checks identity evidence before tenant, action scope and role. Principal tenant describes the caller; Resource tenant describes the target. Admin permits read, write and delete only after the tenant boundary passes. This avoids conflating a broad within-tenant role with authority over another tenant. The trace stops at the first denial, so later checks are marked not-run rather than independently failed or passed.
Supply identity and permission facts
Bearer token present and Authenticator verification passed control the first gates. Verification is an injected result, not cryptographic signature processing. Token issuer chooses trusted or unknown; Token audience chooses this API or another. Seconds until expiry is evaluated at a fixed instant and zero is expired. Application role selects viewer, operator or admin. Requested action selects read, write or delete, and each scope checkbox independently grants its matching action. A role does not manufacture a missing scope.
Reproduce a cross-tenant rejection
Set Role to admin, Requested action to delete and enable Delete scope. With both tenants team-a and valid authentication, the request receives HTTP 200. Change only Resource tenant to team-b: HTTP 403 appears at Tenant boundary and the scope and role gates are not run. Change Principal tenant to team-b as well to allow the same operation. Remove Delete scope to expose a different denial, now at Required scope. Finally remove the token to see an earlier HTTP 401.
Follow the gate sequence
Play inspects eight gates over thirty-two seconds at normal speed; Pause holds progress, Next gate advances, Restart inspection rewinds and Speed changes viewing pace. Edits rebuild and may start playback unless reduced motion is requested. The claim card and preview describe the full selected policy before the final vault result. Expiry does not count down during inspection; change the expiry input explicitly to test another validation instant.
Keep the security assumptions narrow
No JWT is parsed, signature verified, JWK retrieved, OAuth token issued or real endpoint contacted. This is deterministic application policy over supplied claims. Clock skew, revocation, resource ownership below tenant level, token refresh and multiple audiences are absent. The chosen HTTP codes and gate order describe this fixture rather than every identity provider. Check the first-denial reason before changing permissions, because adding an action scope cannot repair an invalid audience or a cross-tenant target.