# Audit tenant, authentication, and request security boundaries

Type: research
Status: resolved

## Question

Can any current HTTP, Feishu, filesystem, agent, or database path cross an
Organization boundary, bypass the intended platform/org/project authorization
seams, expose secrets, or accept unbounded hostile input in the initial
production topology?

## Answer

Yes. Basic org-admin HTTP/Prisma scoping is correctly enforced and its 28
targeted integration tests pass, but the agent inherits service secrets and can
read sibling files, MCP file/context tools accept real targets outside the run
objects, queued/card actions do not consistently bind or reauthorize their
target, non-ACTIVE tenants can still trigger agents, and Feishu/provider
credentials remain global instead of ADR-0021 org-scoped encrypted secrets.
Current Node and Rust dependency audits also fail on high/vulnerability/unsound
advisories.

The complete contract mapping, reproductions, positive evidence, advisory
inventory, and required release proofs are in the
[tenant, authentication, and request security audit](../assets/tenant-auth-security-audit.md).

The newly-clear implementation and decision frontier is:

- [Confine the agent runtime and protect service credentials](16-confine-agent-and-protect-credentials.md)
- [Close MCP context and file-delivery escape paths](17-close-mcp-data-egress-escapes.md)
- [Bind and reauthorize deferred and card actions](18-bind-and-reauthorize-deferred-actions.md)
- [Design the org-scoped secret and connection control plane](19-design-org-scoped-secret-control-plane.md)
- [Design the production browser and session boundary](20-design-production-web-session-boundary.md)
- [Clear dependency advisories and gate releases](21-clear-dependency-security-advisories.md)
- [Enforce Organization status at the shared authorization seam](22-enforce-organization-status.md)

Inbound Feishu file count/size/MIME and request-rate policy remain owned by
[Define initial abuse and capacity controls](05-define-abuse-capacity-controls.md)
rather than being guessed in this audit.