The vendor that could reach every customer
A monitoring vendor asks every customer to create a role its account may assume, and hands out the same instructions to all of them. Hundreds of accounts now trust one principal.
A role identifier is not a secret, and the vendor's software will use whichever one it is pointed at. Another tenant of the same vendor can hand over somebody else's role identifier and ask the vendor to go and act on it. The vendor is the deputy, and nothing in the request tells it whose behalf it is acting on.
Boundaries, outermost first: Customer accounts: Tenant A's role (trusts the vendor; FAILED: reachable today), Tenant B's role (trusts the vendor) The vendor: Vendor software (acts for everyone; FAILED: one identity) Outside every boundary: Tenant B (hands over A's id), an empty slot for the different for every tenant Connections: Tenant B calls Vendor software — names A's role (step 1) Vendor software calls different for every tenant — adds its own value (step 2) different for every tenant calls Tenant B's role — the only match (step 3) different for every tenant must NOT reach Tenant A's role — B's value, A's role