16 lines
702 B
Markdown
16 lines
702 B
Markdown
# Tenant Isolation Review Packet
|
|
|
|
Run the read-only pre-audit against the deployed tenant state root and retain
|
|
the JSON output with the deployment evidence:
|
|
|
|
```bash
|
|
python3 packages/casan-harness/scripts/bash/tenant-isolation-review.py \
|
|
--root /srv/casan/state/tenants --out tenant-isolation-review.json
|
|
```
|
|
|
|
The tool checks partition permissions, unexpected entries, forbidden symlinks,
|
|
tenant key permissions and reused local tenant-key material. A non-zero result
|
|
blocks promotion until findings are resolved. It does not assess identity
|
|
provider claims, database row-level controls, network isolation, application
|
|
authorization logic or cloud KMS policy; those must be assessed independently.
|