CASAN/docs/compliance/TENANT_ISOLATION_REVIEW.md

Tenant Isolation Review Packet

Run the read-only pre-audit against the deployed tenant state root and retain the JSON output with the deployment evidence:

python3 packages/casan-harness/scripts/bash/tenant-isolation-review.py \
  --root /srv/casan/state/tenants --out tenant-isolation-review.json

The tool checks partition permissions, unexpected entries, forbidden symlinks, tenant key permissions and reused local tenant-key material. A non-zero result blocks promotion until findings are resolved. It does not assess identity provider claims, database row-level controls, network isolation, application authorization logic or cloud KMS policy; those must be assessed independently.