Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Tenant isolation”
11 publicationsRoll out configuration changes as carefully as code
Flags, policy rows, generated files and customer settings triggered several global outages between 2024 and 2026. Seven primary incident reports show how each change slipped past its safeguards, and which controls their authors adopted afterward.
Resilience · Amazon Web Services / Microsoft Azure / Google Cloud / Cloudflare / CrowdStrike · By Cloud Security DeskTest PostgreSQL row-level security with the application role
Row-level security only filters queries from roles that do not bypass it. Test with the production login role, through the production pooler, with transaction-local tenant context and a patched minor release.
Workload security · PostgreSQL / PgBouncer / Amazon Web Services / Microsoft Azure / Google Cloud / Supabase · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security DeskDesign application authorization before writing Cedar policies
Define business actions, trustworthy entities and tenant boundaries before writing Cedar policies, then make the application responsible for enforcing the resulting decision.
Identity & access · AWS / Cedar · By Cloud Security DeskChoose who can share an inference prefix cache
Choose the principals allowed to share prefix state, then carry that decision through request routing, offload, transfer and restore.
AI systems · vLLM / NVIDIA · By Cloud Security DeskGive Kubernetes admission webhooks an explicit failure contract
Treat an admission webhook as a control-plane dependency with explicit behavior for denial, call failure, mutation and the changes needed to repair it.
Workload security · Kubernetes · By Cloud Security DeskChoosing isolation for a Kubernetes tenant
A namespace, a virtual control plane and a sandboxed runtime protect different boundaries. Start with tenant authority before choosing the cluster architecture.
Workload security · Kubernetes / gVisor / Kata Containers · By Cloud Security DeskThe telemetry collector is part of the evidence boundary
Review sender identity, tenant routing, processing and export as separate trust boundaries before treating collected telemetry as dependable evidence.
Detection & response · OpenTelemetry · By Cloud Security DeskKeep tenant data out of reusable AWS Lambda state
Reuse clients and connections deliberately, while keeping request identity, temporary files, and initialization snapshots inside clearly defined data lifetimes.
Workload security · AWS · By Cloud Security DeskRoll out Kubernetes Pod Security Admission without surprises
Stage namespace enforcement around the Pods a controller will create next, with explicit policy versions, runtime checks, and narrowly owned exceptions.
Workload security · Kubernetes · By Cloud Security DeskQwen3.8-Flash-Next and GLM-5.3-Flash share a 3:1 long-context pattern
Both models replace most conventional attention layers with recurrent state and reserve sparse attention for periodic retrieval. Their differences lie in where they place capacity, how much neural computation they activate, and what their serving stacks must keep trustworthy.
AI systems · Resilience · By Umair Akbar and Ahmed Elshekh