Commercial answer
Prevent cross-client contamination by assigning every account, list, template, campaign, conversation, ticket, export, and integration to an explicit client workspace. Apply ownership in the data query, not only the interface. Block ambiguous records, preserve per-client contacted state, restrict exports, and test that one client's users and tokens cannot discover or act on another client's data.
The most damaging agency error may look ordinary in the interface: Client A's account sends Client B's message to a lead imported from Client C's source. The components were valid. Their ownership was not.
Isolation must follow the entire object graph. A workspace selector alone is not a security boundary.
Inputs for the model
01A client ownership model for every object.
02Controls for templates, contacted state, and exports.
03Permission and integration tests.
04A wrong-client incident response.
Assign ownership at creation
| Object | Required client context |
|---|---|
| Telegram account | Permitted workspace, owner, purpose |
| Source and list | Client, acquisition purpose, retention |
| Template | Client brand, approved claims, version |
| Campaign | Client, account set, list set, approver |
| Conversation and ticket | Inherited client plus explicit owner |
| Export and integration | Client scope, requester, reason, expiration |
Enforce ownership in every query
TeleBoost's ownership model distinguishes personal data from the active team context. The same principle must reach every endpoint and worker, not only pages displaying lists.
- Solo data requires the current user and no team context.
- Team data requires active team membership and the active team ID.
- Counts, searches, caches, exports, and background workers use the same rule.
- Changing the interface selection invalidates or scopes cached data.
- Missing team context fails closed or returns only the permitted solo scope.
Treat templates and contacted state as client data
Teams often protect leads but reuse a template with the wrong brand, promise, link, or sender identity. Templates need client ownership and approval history.
Contacted state also needs deliberate scope. A lead contacted for one client may or may not be eligible for another purpose. Do not assume either global exclusion or unrestricted reuse. Apply contract, conflict, privacy, and recipient-preference rules.
Test the boundary
- Search Client A for a known Client B lead.
- Attempt to attach Client B's account to Client A's campaign.
- Use a Client A integration token against Client B identifiers.
- Inspect caches after switching workspaces.
- Run background processing with intentionally conflicting IDs.
- Export data and verify only the active client appears.
- Remove a team member and confirm access ends.
Respond to wrong-client contact
- Pause the affected campaign, account, and related queues.
- Suppress further contact while preserving evidence.
- Identify every affected recipient and client.
- Review the ownership failure across query, cache, import, and approval paths.
- Notify responsible stakeholders under the applicable incident process.
- Correct the control and test isolation before restart.
Agency rule: convenience never justifies a shared client spreadsheet, all-client API token, or global template library without ownership and approval controls.
Research note
Client isolation requirements depend on contracts, data-protection roles, and system architecture. This guide is operational guidance, not legal advice or a security certification.
Pressure-test the economics
Pick one lead, one template, one account, and one integration token. Trace the client context through every read and action.
Agencies earn trust when a client can be confident that scale does not make their data, brand, or conversations interchangeable.
Operate clients in separate contexts: TeleBoost for agencies supports personal and isolated team workspaces across the acquisition and reply workflow.
Continue the operating system