# Namespace isolation

URL: /systems/trust-and-governance/controls/namespace-isolation · Id: `control:namespace-isolation`

> A namespace reads and writes only its own records, unless an Agreement grants a scoped read.

A namespace reads and writes only its own records, unless an [Agreement](/business/nouns/agreement) grants a scoped read.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1) | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| [SOC2 C1.1](/systems/trust-and-governance/criteria/soc2/c1-1) | The entity identifies and maintains confidential information to meet its confidentiality objectives. |
| [ISO27001 A.8.3](/systems/trust-and-governance/criteria/iso27001/a-8-3) | Access to information and assets is restricted according to the access control policy. |
| [GDPR Art.32](/systems/trust-and-governance/criteria/gdpr/art-32) | Controllers and processors implement security appropriate to the risk, including encryption, resilience and regular testing. |

## Implemented by
- [Security](/workflows/processes/security)
- [Verification](/code/verification)
- [Tenancy](/code/platform/tenancy)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every cross-namespace read attempt, including the control tester’s daily probes. |
| Assert | Each attempt cites an Agreement granting that scope or ends `refused`. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A bookkeeping service tries to read a sibling [Startup](/business/nouns/startup)'s [Customers](/business/nouns/customer). The read ends `refused`, because no Agreement grants that scope.