skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

tenant-file-isolation

Design tenant-level file namespace isolation in multi-tenant SaaS object storage.

Updated Mar 29, 2026
Search Tags:#security#isolation#iam#object-storage#multitenancy#db-ownership#prefix-schema
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-file-isolation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tenant-file-isolation
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/tenant-file-isolation
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill tenant-file-isolation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Designs and enforces tenant-level file namespace isolation in multi-tenant SaaS object storage.

Core Features & Use Cases

  • Provides a scalable prefix schema (e.g., tenants/{tenant_id}/uploads, media, exports, tmp) and guidance for consistent isolation across services.
  • Covers IAM prefix scoping, per-tenant access controls, and database-owned ownership checks to prevent cross-tenant data access.
  • Supports auditing and migration planning for transitioning from flat storage to tenant-scoped layouts.

Quick Start

Provide the tenancy model and tenant identity mechanism to review and adapt the recommended isolation patterns.

Frequently Asked Questions about tenant-file-isolation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I isolate tenant files in multi-tenant object storage?▼

Isolate tenant files by applying a scalable prefix schema with per-tenant prefixes or dedicated buckets, enforcing IAM prefix scoping and database-owned ownership checks to prevent cross-tenant access.

What is the best way to prevent cross-tenant data access in shared SaaS buckets?▼

Prevent cross-tenant data access by implementing IAM prefix scoping and database-owned ownership checks alongside a strict prefix schema to ensure users only reach their authorized storage namespaces.

How does database-owned ownership checking work for tenant file isolation?▼

Database-owned ownership checking validates tenant identity against the database before authorizing object storage access, ensuring server-side key construction maps securely to verified tenant records.

Can I use IAM prefix scoping for multi-tenant SaaS storage isolation?▼

Yes, IAM prefix scoping restricts access to specific tenant directories, working with a structured prefix schema like tenants/{tenant_id}/uploads to enforce boundaries within shared storage buckets.

How do I migrate from flat storage to a tenant-scoped prefix layout?▼

Migrate to tenant-scoped layouts by adopting a consistent prefix schema and following lifecycle guidelines that support auditing and structured transitions from flat storage to isolated tenant namespaces.

When should I use dedicated per-tenant buckets instead of shared bucket prefixes?▼

Use dedicated per-tenant buckets for stronger isolation boundaries when scale permits, or use shared buckets with per-tenant prefixes when managing higher tenant volumes with IAM scoping.

Related Skills

Explore More Software Engineering Skills→
e-t-y-be-t-y-b
9

saas-architect

Architect multi-tenant SaaS architectures with isolation, billing, and governance patterns.

Official
Advanced
pphatdevpphatdev

file-uploads

Automate tenant-isolated file uploads with chunking, validation, and metadata auditing.

Community
Advanced
FiventsFivents

multi-tenant-architecture

Enforce organization-based data scoping to prevent cross-tenant leakage.

Official
Advanced
marquesfelipmarquesfelip

private-object-access-control

Enforce private object access control on S3-compatible storage with bucket policies and IAM scopes.

Community
Advanced