Shared resources do not leak between tenants

Shared resources — system templates, integration presets, global configuration — are a legitimate multi-tenancy pattern, but the absence of a schema-level distinction between shared and tenant-owned resources means any authenticated tenant can modify data visible to all other tenants. CWE-732 and OWASP A01 both apply. The business impact ranges from corrupted onboarding templates that affect every new signup, to shared integration presets poisoned with malicious data that other tenants then import into their workflows.

Establish a schema-level distinction between system-owned and tenant-owned resources, then enforce it in every write path:

// schema.prisma
model Template {
  id             String  @id
  isSystem       Boolean @default(false)  // true = platform-owned, read-only for tenants
  organizationId String?                  // null = system template
}

// API write handler
const template = await db.template.findFirst({ where: { id: params.id } })
if (template?.isSystem) {
  return new Response('Cannot modify system templates', { status: 403 })
}
if (template?.organizationId !== session.user.organizationId) {
  return new Response('Forbidden', { status: 403 })
}

For tenant customization, create a tenant-specific copy via a fork operation rather than mutating the shared original — store it with isSystem: false and the tenant's organizationId.