Namespace isolation
A namespace reads and writes only its own records, unless an Agreement grants a scoped read.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC6.1 | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| SOC2 C1.1 | The entity identifies and maintains confidential information to meet its confidentiality objectives. |
| ISO27001 A.8.3 | Access to information and assets is restricted according to the access control policy. |
| GDPR Art.32 | Controllers and processors implement security appropriate to the risk, including encryption, resilience and regular testing. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every cross-namespace read attempt, including the control tester’s daily probes. |
| Assert | Each attempt cites an Agreement granting that scope or ends refused. |
Owner
Security Engineer, Engineering Team.
Example
A bookkeeping service tries to read a sibling Startup's Customers. The read ends refused, because no Agreement grants that scope.