Audit on Momo Engineering Journal/tags/audit/Recent content in Audit on Momo Engineering JournalMomo Engineering Journal/images/og-image.png/images/og-image.pngHugoen-usFri, 09 Oct 2026 20:36:52 -0600Tenant Isolation: Deriving Per-Tenant Keys, Enforcing ACLs, and Proving What Happened/posts/053-multitenancy-authorization-audit/Tue, 25 Aug 2026 03:25:29 +0000/posts/053-multitenancy-authorization-audit/How momo isolates tenants without a central secret server: HKDF-derived per-tenant keys, default-deny ACLs evaluated per request, and a SHA-256 hash-chained audit log that makes tampering detectable. Teaches: key derivation vs. key storage, why ACL evaluation order matters, and how hash chaining turns a log into evidence.