feat: add tenant isolation pre-audit evidence

2026-07-18 09:04:39 +07:00
parent 36158c5e34
commit e50714d622
5 changed files with 105 additions and 0 deletions
@@ -0,0 +1,15 @@
+# Tenant Isolation Review Packet
+
+Run the read-only pre-audit against the deployed tenant state root and retain
+the JSON output with the deployment evidence:
+
+```bash
+python3 packages/casan-harness/scripts/bash/tenant-isolation-review.py \
+  --root /srv/casan/state/tenants --out tenant-isolation-review.json
+```
+
+The tool checks partition permissions, unexpected entries, forbidden symlinks,
+tenant key permissions and reused local tenant-key material. A non-zero result
+blocks promotion until findings are resolved. It does not assess identity
+provider claims, database row-level controls, network isolation, application
+authorization logic or cloud KMS policy; those must be assessed independently.