# Tenancy and identity

URL: /products/api/tenancy-and-identity · Id: `page:products/api/tenancy-and-identity`

> Each Customer of an API holds one Tenant; its people, keys and agents act inside it, and every call records who acted and for whom.

Each [Customer](/business/nouns/customer) of an API holds one [Tenant](/business/nouns/tenant): the partition of records, keys and [Limits](/business/nouns/limit) that belongs to it. Every call names who made it and whom it was for.

## One Tenant per Customer
When Harbor Residential became a Leaseline Customer, [`Tenant.provision`](/business/nouns/tenant/provision) made its Tenant with keys, defaults and an admin invitation in one [Action](/business/nouns/action). Its leases live there, and no query from another Customer reaches them, whatever its filter.

Limits apply per Tenant, so one Customer's traffic never spends another's capacity. [Tenancy](/code/platform/tenancy) is the capability underneath.

## Who acts inside a Tenant
| Who | How they get in | What they hold |
| --- | --- | --- |
| A [Person](/business/nouns/person) at the Customer | [`Tenant.invite`](/business/nouns/tenant/invite), or the Customer's own sign-in | A session in the [Portal](/business/nouns/portal) and the [App](/business/nouns/app) |
| The Customer's people, in bulk | Single sign-on and directory sync, set up through [`Tenant.requestSetup`](/business/nouns/tenant/request-setup) | Membership that follows the Customer's directory |
| The Customer's code | A key made in the Portal | A `test` or `live` key that reaches this Tenant only |
| The Customer's [Agent](/business/nouns/agent) | A key, or a [Mandate](/business/nouns/mandate) to buy on the Customer's behalf | The same reach as the key or Mandate it carries |

[Customer access](/systems/customer-access) runs members, invitations, sign-in and keys. [Your customers' API keys](/products/api/customer-keys) covers making, scoping, rolling and revoking keys.

## By and for
Every Action records its caller as `by` and the [Party](/business/nouns/party) it serves as `for`. When Harbor Residential's sync renews a lease, the Action names the sync's key as `by` and Harbor Residential as `for`.

An Agent acting under a Mandate records the Agent as `by`, the Customer as `for`, and the Mandate it acted under. Receipts, Limits and support all reach the right party from those two fields.

## The builder side
Leaseline's own [Workers](/business/nouns/worker) never hold a Customer's key. Its [Success Manager](/agents/customer/success-manager) agent holds a session key for its [Role](/business/nouns/role) on the builder plane, which reaches every Tenant that Role grants. Revoking that key stops that agent and nothing else.