---
name: Shared Identity - mql-enrichment-service
description: Shared-identity L7 concern. Tenant-scoped JWT issued by {{idp_name}} propagates through every platform's call chain. Cross-tenant isolation verified 2026-04-19.
type: cross-platform-artifact
layer: L7-concern
Owner: Platform Engineering; lead {{platform_eng_lead}}
---

# Shared Identity - mql-enrichment-service

- **Last reviewed:** 2026-04-19
- **Review cadence:** quarterly + on identity provider change
- **Status:** exists-mature

## What this means here

A single tenant identity propagates through every L5 platform's call chain so each platform can authorize against the same tenant scope. Without shared identity, each platform would re-authenticate independently; tenant boundaries would weaken.

## Implementation

- **IdP:** {{idp_name}}
- **Token format:** JWT signed by {{idp_name}}; bearer in `Authorization` header
- **Required claims:** `sub` (subject), `tenant_id`, `iat`, `exp`, `aud` (audience for the platform being called)
- **Validation:** every platform validates against `{{jwks_endpoint}}`; signature, expiration, audience, tenant scope all checked
- **Trust boundary:** `tenant_id` claim is authoritative; any cross-tenant access attempt hard-rejects at the API gateway with 403 + audit log
- **Issuance:** {{cutting_edge_saas_company}} workforce SSO for human callers; service-account flow for inter-pod calls
- **Rotation:** 90 days for service accounts; SSO sessions per {{cutting_edge_saas_company}} corporate policy

## Participants

| Platform | Validates JWT | Issues sub-tokens | Notes |
|----------|---------------|-------------------|-------|
| mql-enrichment-service | yes | no | Validates inbound calls from queue consumer + admin tooling |
| mql-router | yes | no | Validates inbound calls from mql-enrichment-service |
| sdr-handoff-helper | yes | no | Validates inbound calls from {{crm_name}} integration; also validates SDR identity claim |

No platform issues sub-tokens; all tokens originate from {{idp_name}}.

## Cross-tenant isolation drill

**Last drill:** 2026-04-19

**Procedure:** Synthesized a JWT for tenant A (test tenant `qa-tenant-001`) targeting tenant B's queue (test tenant `qa-tenant-002`). Submitted at API gateway.

**Result:** rejected at API gateway in 12ms with 403; audit log entry captured (`auth.cross_tenant_attempt = blocked`); no downstream call attempted.

**Pass criteria:** rejection must occur at the gateway (not at the platform code), latency must be under 50ms (not slow enough to enable timing attacks), audit log must capture the event.

All criteria met. Drill recurs quarterly.

## Last verified live

2026-04-19 cross-tenant isolation drill (above). Plus: every production call validates JWT and emits the validation result to telemetry; spot checks against the audit log confirm validation is happening on every call (not bypassed).

## SDR identity propagation (sdr-handoff-helper specific)

For `sdr-handoff-helper`, the SDR's identity is propagated as a separate claim within the tenant-scoped JWT. The helper card renders SDR-specific context (e.g., "5 of your other leads from this company are in flight"). SDR identity is verified at the {{crm_name}} integration boundary; downstream platforms trust it.

## Inheritance and dependencies

Inherits from: {{cutting_edge_saas_company}} corporate identity architecture; {{idp_name}} as the org's IdP.

Consumed by: every L5 dossier in this instance.

## Cross-references inside this instance

- `cross-platform/L7-glue.md`
- `policies/framework-contract.md` (L3) - auth model section
- `runbooks/identity-incident.md` - what to do if {{idp_name}} is down
- `runbooks/cross-tenant-drill.md` - quarterly drill procedure
