Stop requests from choosing another customer’s account
An authorized write must remain in the account it was authorized for. Wildo reconciles the caller’s identity, addressed scope and server-managed ownership fields so request data cannot quietly move the operation into another tenant.
This protects the create and update path as well as the records returned by a query.
Example — A request carries the wrong organization
An integration authenticated for one organization calls a route naming another. The mismatch is refused instead of creating a record under the organization named in the request.
For engineers
A machine token names its scope. The execution-context creator compares the addressed scope with that authenticated value before constructing the request context:
This implementation excerpt from execution-context-creator.backend.service.ts shows the decision in context; explanatory source comments are omitted.
const urlScopeId = machineScope === ResourcePrimaryScope.ORGANIZATIONS
? initiatorCriticalParamsValue.organizationId
: initiatorCriticalParamsValue.applicationId;
if (urlScopeId && urlScopeId !== machineToken.scopeId) {
throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined,
{ customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_MACHINE_SCOPE_MISMATCH,
context: { reason: 'machine_scope_url_mismatch', tokenScope: machineScope } });
}
const machineCredential = { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: machineToken.clientId };
const initiatorIds: ExecutionContext_InitiatorIds = machineScope === ResourcePrimaryScope.ORGANIZATIONS
? { ...this.extractInitiatorIds(initiatorCriticalParamsValue), organizationId: machineToken.scopeId, machineCredential }
: { ...this.extractInitiatorIds(initiatorCriticalParamsValue), applicationId: machineToken.scopeId, machineCredential };
Keep ownership fields server-authored
Generated operation input shapes exclude contextual ownership fields from normal caller-controlled data. The resource operation path then enriches the write using its resolved context. Build scoped API calls with the intended organization in the route and ordinary business fields in the payload; do not rely on a payload organizationId to establish authority.
| Input | Responsibility |
|---|---|
| Authenticated principal | Establishes the caller and its authority |
| Addressed route/context | Identifies the scope and resource being requested |
| Business payload | Supplies the values the operation allows the caller to change |
| Contextual enrichment | Supplies server-managed ownership fields |
The exact refusal depends on the stage: invalid identity, inaccessible scope and disallowed input are different cases. Do not interpret an ignored extra property as proof that it was trusted.
A reference inside the payload still has its own eligibility question. Membership-constrained relationships prevent a valid tenant write from linking an ineligible person or partner.