The row exists
A query finds a real record, but its workspace does not match the workspace visible in the interface.
The Active Workspace Integrity Audit
Valid data. Wrong workspace.
A practical field guide for keeping multi-workspace reads, writes, billing, automation, and cached state bound to the context the user can actually see.
Get the auditSee the context contract
The hidden failure
Authentication is necessary. It is not the workspace.
A signed-in person may legitimately belong to several workspaces. If each screen, server action, cache, billing path, or automation chooses context independently, the system can return valid records and still be wrong.
Permission passes
The user may own both workspaces, so a broad authorization check cannot detect the wrong destination.
The old context survives
A cache, thread, subscription, or pending request remains bound to the previous workspace after a switch.
The five-fact contract
Resolve context once. Prove it everywhere.
01Identity
02Active workspace
03Membership
04Resource
05Side effect
Identity
Who is signed in, and which server-trusted session is making the request?
Active workspace
Which explicit workspace is active now—not first, oldest, default, or previously cached?
Membership
What role and permissions does this identity have in that exact workspace?
Resource
Does the requested record, subscription, file, job, or conversation belong to that workspace?
Side effect
Where will the write, charge, export, email, automation, or model action actually land?
Switch boundary
What state must be canceled, invalidated, or re-keyed when the active workspace changes?
First-party correction
Every answer was plausible. The context rules disagreed.
An internal multi-workspace SaaS audit found read and write paths that resolved a workspace differently from the interface, workspace-bound state that could survive a switch, and billing surfaces that scoped subscriptions differently from entitlement checks. The repair centralized active-workspace resolution, bound reads and writes to the same context, checked current entitlement state, and reset workspace-bound state on switch. The lesson is shared without product identity, workspace names, users, account counts, providers, data values, infrastructure, or customer claims.
Two-workspace test matrix
Single-workspace QA cannot reveal this class of bug.
Read tests
Create distinct, recognizable records in workspaces A and B. Verify every list, detail, search, dashboard, export, and deep link after switching.
Write tests
Create, update, delete, upload, invite, and automate from each workspace. Verify the destination at the data layer, not only in the toast.
Entitlement tests
Give the workspaces different plans and states. Compare subscription, wallet, feature gates, usage, invoice, and checkout destination.
State tests
Switch during a pending request, open overlay, cached thread, background job, streamed response, and another browser tab.
Authoritative guidance
Tenant isolation belongs in every request.
OWASP recommends least privilege, deny by default, and permission validation on every request. AWS multi-tenant guidance treats tenant isolation as fundamental to SaaS design. PostgreSQL documents row-security policies for restricting visible and modifiable rows. These are layers of the solution; none substitutes for an explicit active-workspace contract in the application.