Security & Trust
Sovereign Zero-Trust: Defense in Depth for Multi-Tenant Operating Systems
Why perimeter security is obsolete, and how cryptographic row-level security, signed short-lived URLs, and audit graphs prevent corporate data exfiltration.
Taras Shevchenko
Staff Infrastructure Engineer
Published on 2026-09-10
6 min read
Key Takeaways
Never trust client-supplied tenant identifiers; identity and company scope must resolve strictly from cryptographic session claims.
Row Level Security (RLS) policies at the database layer prevent cross-tenant data leaks even in the event of application-level bugs.
Private document storage must use signed, time-limited tokens (<=60s) rather than public object URLs.
Immutable event audit logging in activity_events provides forensic accountability for every privileged mutation.
1. The Fallacy of Perimeter-Based Enterprise Security
Traditional corporate intranets relied on VPN perimeters: once you authenticated past the firewall, you were trusted. In modern distributed startups, employees operate from coffee shops, mobile hotspots, and personal devices.
The network perimeter is dead. The new perimeter is cryptographic identity coupled with deterministic row-level policy enforcement.
2. Kernel-Level Tenant Isolation via Supabase PostgreSQL RLS
At Sferafy, every single table enforces PostgreSQL Row Level Security. Even if an attacker manipulates an API parameter or injects a malicious payload, the database engine itself rejects queries that attempt to access records outside the authenticated company UUID:
`CREATE POLICY "tenant_isolation" ON sferafy.employees FOR ALL USING (company_id = (SELECT current_company_id()));`
This eliminates entire classes of BOLA (Broken Object Level Authorization) and IDOR vulnerabilities by architectural design.
Never execute database queries with a service-role superuser key on behalf of end-user sessions. Always scope queries to the authenticated tenant token.
3. Ephemeral Signed Access & Immutable Event Bus
Contracts, salary slips, and medical leaves are never stored with static public URLs. Sferafy issues ephemeral HMAC-signed URLs valid for at most 60 seconds.
Furthermore, any high-impact mutation—from salary updates to account status freezes—emits an immutable audit row into our activity ledger, preventing repudiation and guaranteeing full compliance readiness.
Tags:Zero TrustPostgreSQL RLSOWASP Top 10CybersecurityData Sovereignty