Resolve the host before the record
Use an approved domain map to resolve the site. Never treat a client-supplied site_id as authority. The article lookup then combines the resolved tenant with the requested slug, so a guessed identifier cannot select a neighbouring tenant’s draft.
Carry identity through the queue
A background worker has no browser request to inherit. Jobs must contain an explicit tenant identifier, re-establish context and check authorisation before mutating data. Cache keys, file paths and revision records need the same treatment.
Test the inconvenient paths
Test unknown domains, duplicate slugs, cross-tenant relationships and cached responses. A public article may be readable by everyone; unpublished records and editing permissions still require isolation. Logical tenant checks do not contain a root-level server compromise.
