Tenant data might mix? Design isolation tests with fake accounts

Give a text AI fake tenants and a role-access matrix to draft a list of allowed and denied test cases for human review. This is a drafting exercise; the source used Replit Agent.

Execution environment and usage

AI / software

General text chat (example: Claude)

Where to operate

A general text-AI conversation; for example, a new chat on the Claude website where available. This is a text exercise, not an agent run.

Getting started

  1. Open an authorized text-chat tool; Claude’s web entry is claude.ai.
  2. Paste the relevant text from fake tenants and a role-access matrix and the prompt below; request a list of allowed and denied test cases.

Setup and plan requirements

Prepare shareable, de-identified fake tenants and a role-access matrix; paste only relevant excerpts. An available chat account and allowance are needed; Claude also has location and age requirements. This exercise needs no connector or execution permission from the original source workflow. The chat can produce the text draft. Any later checks of actual files, screens, audio or test results require a person, suitable software and existing outputs. Mark checks unverified when those outputs are absent.

Prompt portability limits

Questions and supplied text can be adapted to another capable chat tool. This produces a draft, not file access, code execution, account connections or the original operational outcome.

Usage limitations

The source reports Replit Agent. This page adapts it into a list of allowed and denied test cases, not a completed automated workflow in that product. Follow the checks below; source outcomes do not establish this exercise’s results.

Environment sources

適用情境 / When to use

Give a text AI fake tenants and a role-access matrix to draft a list of allowed and denied test cases for human review. This is a drafting exercise; the source used Replit Agent. The author emphasizes continued human checking.

步驟 / Steps

  1. Use an authorized sandbox, fake tenants and synthetic records with an access matrix.
  2. Design allowed and denied read/write cases, separating test and production environments.
  3. Check cross-tenant denials against known expectations and record gaps without certifying security.

提示詞 / Prompt

Using [sandbox data model] and [tenant/role access matrix], design isolation tests with fake identifiers and synthetic records. List allowed, denied and indeterminate read/write cases. Produce a plan only; do not execute attacks, change permissions or connect to production. Identify items requiring professional review.

留意事項 / Cautions

  • Do not use real customer data or probe third-party systems.
  • Passing tests is not a security certification.

來源限制 / Evidence limits

The report is not independently reproduced or a comprehensive platform security assessment.

流程說明 / Workflow note

These steps and prompts are original, untested exercises by this site, not the author’s verbatim workflow. Reported results do not guarantee exercise outcomes.

原始工具組合 / Original tool stack

Replit Agent; Architect; application database

Source checked: 2026-10-19

My first serious Replit build: a production multi-tenant SaaS