feat: add tenant isolation pre-audit evidence

2026-07-18 09:04:39 +07:00
parent 36158c5e34
commit e50714d622
5 changed files with 105 additions and 0 deletions
@@ -0,0 +1,15 @@
+# Tenant Isolation Review Packet
+
+Run the read-only pre-audit against the deployed tenant state root and retain
+the JSON output with the deployment evidence:
+
+```bash
+python3 packages/casan-harness/scripts/bash/tenant-isolation-review.py \
+  --root /srv/casan/state/tenants --out tenant-isolation-review.json
+```
+
+The tool checks partition permissions, unexpected entries, forbidden symlinks,
+tenant key permissions and reused local tenant-key material. A non-zero result
+blocks promotion until findings are resolved. It does not assess identity
+provider claims, database row-level controls, network isolation, application
+authorization logic or cloud KMS policy; those must be assessed independently.
@@ -74,6 +74,7 @@
 | APPI/data-processing documentation | 🟡 template ready | `docs/compliance/APPI_DATA_PROCESSING.md` records the customer/project/model data register, retention, transfer and incident-review evidence. Complete and approve it with the Japanese privacy/legal owner for each production tenant. |
 | Japanese SLA/support/escalation | 🟡 draft ready | `docs/jp-poc/07_本番SLA・サポート・エスカレーション案.md` defines severity, ownership and evidence expectations. Finalize service hours, credits, uptime, RPO/RTO and 24x7 coverage only after managed operations/DR are proven. |
 | Certification and audited operations roadmap | 🟡 roadmap ready | `docs/compliance/CERTIFICATION_ROADMAP.md` maps PoC → pilot → ISO/cloud privacy/AI management/government procurement evidence. It expressly forbids claims before the relevant accredited audit or procurement process completes. |
+| Tenant isolation pre-audit | 🟡 CLI + test ready | `tenant-isolation-review.py` checks filesystem partition permissions, symlink escapes and local key separation; retain its output for the independent review. It does not replace an independent identity/database/network isolation assessment. |
 ---

 ## Trần điểm & điều kiện lên "Strong (81+)"