Tenancy and identity in a Service
Whose records are whose in a Service: the buyer's Tenant, the Startup's own workers, each Supplier's identity, and the two front doors.
A buyer's briefs, files, deliveries and verdicts live in its own Tenant. The Startup's workers do the work inside it, and the buyer sees the result and its evidence, never the workers' Memory.
What belongs to whom
| Record | Belongs to | Who sees it |
|---|---|---|
| The brief, the catalog and every delivered file | The buyer's Tenant | The buyer, and the workers on its Order while they work it |
| Each Evaluator verdict on its work | The buyer's Tenant | The buyer, as the evidence for each line |
| The steps, rubrics and Role contracts | The Startup | The Startup only |
| Each Supplier's Credentials and earnings | The Supplier and the Startup | Never the buyer |
A buyer who leaves keeps what it was delivered. Nothing is purged: a deleted record leaves every list, keeps its history and can be restored.
Who the buyer deals with
The buyer deals with the Startup, never with one worker. Messages come from the Startup's own address, and an agent says it is an AI agent in its first message of each conversation.
A Supplier works under the Startup's Agreement with them and the terms of each Task. Its identity, tax details and Credentials are verified at onboarding, and its standing is read again before each Task the law reserves.
A buyer's agent
A buyer's agent acts for its principal under a Mandate. Every Action it takes records by the agent and for the buyer, so receipts, Limits and disputes reach the right party.
Two planes
| As your customer | As the builder | |
|---|---|---|
| Host | api.catalogmend.com | api.sb/ |
| Package | catalogmend | startup-builder |
| Key | Issued in the Portal | The builder's own key |
| Reaches | One Tenant: its Orders, deliveries and verdicts | Every Order, the Service, its Offers and steps |
A buyer's code and agents never see api.sb or the startup-builder package.