Administering tenants
Two distinct scopes, deliberately kept apart.
| Scope | Operates on | Typical operator |
|---|---|---|
| Platform administration | All tenants | The organization running the platform |
| Tenant administration | One tenant's own configuration and users | The customer |
Platform administration crosses tenant boundaries and therefore runs under a different authorization scope entirely. A tenant administrator, however privileged within their tenant, cannot reach it.
Tenants
A tenant is an isolated workspace. Isolation is enforced in the database, so a query cannot return another tenant's rows even if application code forgets to filter.
Provisioning a tenant creates it and seeds its permission catalog, so roles can be composed immediately rather than after a separate setup step.
Tenant lifecycle
| State | Meaning |
|---|---|
| Active | Normal operation |
| Suspended | Access blocked; data retained |
| Deleted | Soft-deleted and restorable |
Suspension is reversible and non-destructive, which is what makes it usable for billing or compliance holds without risking data.
Granting the first administrator
A new tenant has no users, and the usual path — a user signs in and is provisioned automatically — cannot bootstrap it, because sign-in resolves tenants a user is already a member of.
Platform administration therefore grants the first tenant administrator explicitly, by naming an identity in the identity provider. Only the provider's identifier is supplied; the identity's details are read from the provider itself, so a caller cannot fabricate an identity that does not exist there.
After that first grant, the tenant administers itself.
Configuration snapshots
A snapshot stores a configuration payload you supply, so you have a record of what a tenant looked like at a point in time.
There is no apply, restore, rollback, or diff operation. A snapshot is a stored record, not a recovery mechanism — reverting a configuration change means making the reverse change yourself.
Do not plan a recovery procedure around them.
Advice
- Keep the two scopes separate in your operating model. Platform administration is infrastructure work; tenant administration is customer work.
- Suspend rather than delete when access must stop but data must survive.
- Record what you changed before a large configuration change, especially to match profiles, where the effect is on data rather than only on configuration. A snapshot stores that record; it will not undo the change for you.
Next
Last verified against commit 315eb047 (2026-08-03)