War-game a tenant isolation rule by testing whether blast capacity, review gates, and freeze deadlines still shrink soft boundaries when several surfaces share one control plane and the next uptime chart is close.
Tenant isolation rules fail when "isolated" means a checkbox without a decision artifact, when teams dual-count a draft as both reviewed and live, and when money-adjacent tenant paths still pin to one thin pool because the map is incomplete. The review needs one written inventory of tenant classes, one owner who can deny a risky shared resource, and a documented consequence when a failed review ages past the deadline.
Assemble the isolation packet
List tenant classes by surface, weekly volume, review gate, last boundary-skip reason, owner of record, and evidence required to keep the rule. Attach open findings, overdue drafts, and any emergency co-tenancy waiver in the last quarter. Name which classes are out of scope and why. If a payments-adjacent tenant class is omitted, show the residual risk in the same packet.
Decide allow, revise, or hold in advance. Include the fields that compute overdue-review status so two reviewers reach the same label from the same exports.
Claim matrix
| Claim | Evidence required | Fail condition |
|---|---|---|
| Class is staffed | Named reviewer roster and measured time-to-isolation check | Roster is empty or still points to a single untested operator |
| Boundary is complete | Control-plane export showing isolated state for the claimed fields | Ticket closed while export still shows shared |
| Priority is unique | Sample tenants proving no double-booked pool | Priority invents uniqueness the pool never enforced |
| Override is controlled | Logged use with time-bound restore of review | Shared override or unlogged use |
Walk four cases in Pingpong: a surface still pinned to one overloaded pool, a boundary that left a customer path live without platform review, a class that mixed batch and interactive traffic, and a request to skip a money tenant because volume is rare. Start from the documented isolation language. Ask who can extend a freeze window and which export proves review. Any step that depends on an unnamed person becomes an isolation condition.
Replay one prior noisy-neighbor incident under the proposed rules. If the incident would still age without a reverse owner, revise the rules before calling the isolation rule ready.
Pair with the platform ops lead seat, a quota burst policy stress test, and a shared infra budget review. More operating decisions live in the war-game decisions hub.
Close only when isolated and blocked labels can be reproduced from stored exports without a verbal override.