How Memox turned a tenant-isolation fix into an engineering standard

Multi-tenant means many firms share one running application. Memox calls each firm an organisation. Tenant isolation is the rule that keeps them apart. Every read, every change and every search has to stay inside the firm that owns the record.

Memox is our own product. We built it and we run it. Businesses use it to cut the hours their staff spend hunting through documents and sales records, by letting a trusted agent do the looking. So keeping one firm’s material away from another’s is not a nice extra. It is the product.

We found a tenant-isolation defect and corrected it. There is no evidence that any tenant’s data was read across the boundary. The part worth telling is what changed in how we work. The fix reached both the server and the dashboard, and the pattern became a rule for everything built after it.

Knowing who someone is and knowing which firm they may act for are two different checks. Both have to hold on every screen.

Signing in proves identity. It does not prove which firm you may act for. A feature has to apply that line when it reads data, when it writes data and when it searches. Write that logic once per feature and the versions drift apart.

The fix landed on April 30, 2026. We moved the affected code onto one shared permission pattern, with every query scoped, meaning limited to the records of one firm. We added regression tests for requests that should be refused. A regression test locks in a bug you have already fixed, so it cannot come back quietly.

The dashboard changed the same day. Switching firm now asks for fresh content instead of holding the last one’s view. That pairing covered what the user sees as well as what the server decides.

Workflow: Organisation context → Shared permissions → Scoped operations → Regression review.

We did not just fix the defect. We made the fix the house rule, so the next person has one pattern to follow and a reviewer who will spot a departure from it.

Review found a way to simplify further. The app already had one standard guard, a single place that decides whether a request is allowed. So we dropped a one-off helper and used that instead. The principle was simple. A future contributor should be able to follow one written pattern, and a reviewer should notice when they have not.

The engineering guide gained a worked example and a test pattern for isolation. The repository instructions carried the rule at once. A numbered checklist followed. Within seventeen days the review standard treated a departure as a blocking issue, not a note. New feature specs now list tenant isolation in their acceptance criteria; the list a feature must satisfy before it counts as done. The same controls apply to work written by people and work written with an agent.

A test only protects you if the pipeline still runs it. So we added a guard against the tests being switched off by accident.

Later we looked at speeding up continuous integration, the system that runs the tests on every change. Review caught a config edit that would have stopped collecting 61 role, organisation and team tests. The workflow we shipped added a guard against that config coming back.

That episode widened the lesson. Four things make one chain: the permission code, the tests, the step that finds the tests, and the review habit. Improve one link while quietly weakening another, and the team believes a boundary is better covered than it is. Reviewing the delivery machinery is part of maintaining the app.

The result is a shared pattern backed by tests and review rules. It is not proof that a growing app has no isolation defects left. A later review found a separate issue elsewhere, which is the point: a written rule does not replace reading the existing code.

If you build across accounts, stores or business units, make four calls up front.

1. Which firm owns a record.
2. Where you check membership.
3. Which actions are scoped.
4. What a refused request looks like.

Those belong in the build and its acceptance criteria from day one.