id: API-005
title: One agency cannot read another agency's booking by id
layer: api
area: Keeping agencies separate
risk: high
owner: qa

preconditions:
  - a confirmed booking exists under the Globetrotter tenant
  - valid credentials for the Skyline tenant

steps:
  given: Skyline holds a valid booking id that belongs to Globetrotter
  when: Skyline requests GET /api/bookings/{that-id}
  then: the API responds 404 Not Found (not 403), leaking nothing about the record

evidence:
  - the GET /api/bookings/{id} request (X-Tenant skyline) and the 404 response
  - the same id fetched successfully as Globetrotter, for contrast (recorded data)

data:
  owning_tenant: globetrotter
  requesting_tenant: skyline

must_not:
  - the response body must not contain the other tenant's passenger or contact data
  - the status must not be 200 or 403 (404 keeps existence hidden)