Multi-tenant SaaS with roles, permissions and an audit log

Deskroute sells one helpdesk application to 140 client companies, who all share the same servers and database. Each client is a tenant, and tenants must never see each other's tickets. During a recent trial, a bug in one query let a tenant admin list tickets from two other companies. The deal nearly collapsed, and a prospect asked for an audit log before they would sign.

You are building the access-control core that the whole product sits on. It has three parts: - tenant isolation, so every query is scoped to the caller's tenant and a missing scope fails closed rather than returning everything; - role-based access control, with roles such as owner, agent and viewer, and a permission check on every action; - an audit log that records who did what, to which record, and when, for the actions that matter.

You will build a small ticketing API on top of this core, with three tenants and a handful of users each, seeded by a script. Done looks like an API where a user from tenant A cannot read, change or even count tenant B's tickets; where a viewer cannot close a ticket but an agent can; and where closing or reassigning a ticket appears in a tamper-evident audit log. The main proof is a test suite that tries every cross-tenant and privilege-escalation attack you can think of and shows each one blocked. The target is zero cross-tenant leaks across the whole suite.