The Contractor Who Crossed Clinics

The story

The Northshore integration came with a body: Dorian Voss, an IT contractor Northshore had used for years, hired on for six months to migrate their staff records. He was competent, fast, and constitutionally incapable of reading a scope-of-work as anything but a suggestion.

Theo Brandt, who ran Northshore, asked for Dorian to get admin rights “so he can sort out our accounts”. Ana’s old system had exactly one kind of admin — the kind that could do everything, everywhere. She’d handed that key to contractors before and spent the following weeks pretending she hadn’t. This time she assigned Dorian the clinic-admin role scoped to Northshore: the role assignment itself carries the organization, so its grants only ever enter permission snapshots minted for Northshore’s context.

Three weeks in, the security feed produced a small cluster of curiosities. Dorian had tried to list Lakeside’s users: the response said Lakeside didn’t have any — for him, it didn’t. He’d tried to look up Amara’s account directly by id: not found. Then something more creative: he attempted to create a new role — grants pointed at Lakeside — from inside his Northshore admin session, presumably reasoning that an admin who can create roles can create any role. The write was rejected at validation: an org role’s grants cannot point at another org, and cannot mint global scope at all.

Ana read the trail with her coffee. Nothing had been breached; everything had been attempted, and every attempt was a line in the ledger with Dorian’s name on it. She forwarded the excerpt to Theo with a one-line note. The scope-of-work conversation that followed was, by all accounts, brief.

Why this is hard the traditional way

Delegated administration is where role systems go to die. “Admin” starts as a boolean. The second tenant turns it into a scoped boolean, which is to say a lie: the admin screens still call the same service methods, and each method must now remember to compare the caller’s org against the target’s org. Every forgotten comparison is a privilege escalation; every remembered one is a copy-pasted if that drifts from its siblings during refactors.

The subtle failure is the write path. Even teams that fence reads correctly forget that role editing is itself a privilege-minting machine: an org admin who can attach arbitrary grants to a role can attach someone else’s org to a role, or a global wildcard, and assign it to themselves. If grants aren’t validated against the editor’s own reach at write time, the fence has a gate with no lock.

How Sentinel changes the ending

Sentinel makes the fence structural rather than disciplinary. An org admin’s reach is derived from their managed-org set — the admin service’s own test suite states the rule: enforcement is never by an org comparison in the service. Targets outside the fence aren’t forbidden; they’re invisible, which kills the enumeration oracle too (not yours and not there are the same 404). The unit tests stage Dorian’s afternoon almost verbatim: Org_admin_cannot_list_get_or_suspend_users_in_another_org, Role_create_and_assign_in_unmanaged_org_fail_even_with_org_manage_elsewhere, Org_role_grants_cannot_mint_global_scope_or_point_at_other_orgs, Org_admin_cannot_create_realm_level_role.

Underneath, the evaluator applies the effective-org rule to every check: a cross-org check honors only grants explicitly restricted to the resource’s org — a realm-wide allow is not a license to reach across tenants. And the whole story is legible afterward: every attempt, allowed or denied, is an event; every admin mutation writes before/after entries onto the tamper-evident chain; and when Ana wanted to know exactly why a check denied, the authorization inspector returned the grant-by-grant trace.

Dorian finished the migration on time, inside the fence. The fence is why he got to finish it.

What it costs you to ignore this

• Contractors are the canonical over-provisioned account — short tenure, broad access, weak offboarding. Unfenced admin rights make every engagement a standing incident.
• One forgotten org comparison is a full tenant breach, and code review is the only thing between you and it — forever, on every new endpoint.
• Unvalidated role editing is self-service escalation. The attacker doesn’t need your admin’s password if your admin screen will mint them a better role.
• Without an attempt trail, near-misses are invisible. Ana’s scope-of-work conversation happened in week three — not in month six, after something worked.