Broken Trust
Tenant boundaries are inconsistent across two synthetic API resources.
API AUTHORIZATION BASICS
APIs expose resources through endpoints like GET /api/v1/projects/17. A bearer token identifies a client, but identification is not permission.
AUTHENTICATION VS AUTHORIZATION
Authentication asks who is making a request. Authorization asks whether that person may access this particular project. Multi-tenant systems must enforce object ownership on every request.
BOLA / IDOR
Broken Object Level Authorization (BOLA), also called IDOR, happens when an API accepts an object ID but fails to verify access rights. A successful response containing another tenant's private project is suspicious.
DEFENSIVE PATTERN
project = db.projects.find(id) if project is None: return 404 if project.tenant != user.tenant: return 403 return project.public_view()
Real applications also consider roles and explicit sharing rules.
ARTIFACTS
GET /api/v1/projects/17
Authorization: Bearer tenant-alpha-demo
HTTP/1.1 200 OK
{"id":17,"tenant":"alpha","name":"relay"}
GET /api/v1/projects/18
Authorization: Bearer tenant-alpha-demo
HTTP/1.1 200 OK
{"id":18,"tenant":"bravo","debugMarker":"objects_need_owners"}HINT 01
Compare the authenticated tenant with the tenant returned by the second object.
KNOWLEDGE CHECK
What is wrong with the supplied API trace?
$ specter start broken-trust [+] briefing loaded [+] browser training mode [+] no external target required
Progress is stored only in this browser.
WHY THIS HAPPENED
The tenant-alpha token retrieved projects belonging to both alpha and bravo. The server authenticated the requester without consistently enforcing ownership of the requested object.
HOW TO FIX IT
Scope project queries to the authenticated tenant, enforce authorization on every object, test cross-tenant negative cases, and remove debug markers from production responses.