Tenancy and identity
How an App keeps each Customer's records apart and decides who may sign in and act there, people and agents alike.
Each Customer of an App gets its own Tenant: a partition of records, keys and Settings no other Customer reaches. Inside it, every Person and agent holds a Persona and an Access Level.
One Tenant per Customer
Tenant.provision runs when a party accepts an Offer. It creates the Tenant, its keys and defaults, and an invitation for its first admin, in one Action.
Riverside Property's Tenant holds its leases, its people and its plan. A query with its key never returns a Harbor Residential record, whatever the filter. The Tenant's data belongs to Riverside Property; Leaseline operates it.
A Customer's team is the Tenant's members. The App has no separate account, team or company record to keep in step.
Personas
A Persona is who signs in and the job they come to do. Leaseline's App declares two: manager, who renews and notifies, and resident, who reads a lease and answers a notice.
Each Persona holds a Role, and the Role holds the Permissions: which Verbs it may call on which Nouns. The App reads that chain, so two Personas in one Tenant see two different Apps from one definition.
Members and Access Levels
Tenant.invite asks a person to join. When the Offer prices per member, the invite resizes the Subscription and prorates it.
| Access Level | May |
|---|---|
owner | Every Verb, one-way Verbs included, each within its delay window |
admin | Every two-way change, access included; one-way Verbs stay with the owner |
member | Every two-way change, except to the Nouns that decide access |
viewer | Read, and change nothing |
An Access Level is a preset of Permissions, never a Role. A Persona says what job someone does; an Access Level says how much of the Tenant they run.
Sign-in
People sign in with a passkey or an email link from the first day. Single sign-on and directory sync come from the Customer's own identity system:
Tenant.requestSetupsends the Customer's IT admin a setup link.- They connect their sign-in, and
SSOConnection.activateturns it on once a test sign-in passes. - A Member Directory pushes their people and groups in, so access follows employment.
A leaver removed from the Customer's directory loses access to the Tenant on the next sync. Set up SSO for a customer walks through it.
Agents as members
A buyer's Agent can accept an Offer and provision a Tenant itself, and a person claims the admin seat later. An agent member holds an Access Level and calls through the same Permissions as a person. Every call it makes leaves an Action with the agent as by and its person as for.
Next
- Tenant settings: what a Tenant's admin changes.
- Customer access: the System behind every part of this chapter.