id: tenant-engine
name: Tenant Engine
resource_types:
  - name: tenant
    scope_level: Resource
    planes:
      - Identity
      - Audit
    metadata:
      description: A tenant record (existence, onboarding grouping).
  - name: role-grant
    scope_level: Resource
    planes:
      - Identity
      - Policy
      - Audit
    metadata:
      description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
  - name: plan-assignment
    scope_level: Resource
    planes:
      - Identity
      - Audit
    metadata:
      description: A tenant's plan/subscription assignment (by reference id).
  - name: guardrail
    scope_level: Resource
    planes:
      - Policy
      - Audit
    metadata:
      description: >-
        A tenant's resolved ceiling (spend, seats, and similar limits) plus
        the provenance of that value. Not an entitlement and not a meter.
actions:
  - name: tenant.create
    capabilities:
      - Create
      - Audit
    planes:
      - Identity
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.role.grant
    capabilities:
      - Grant
      - Audit
    planes:
      - Identity
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.role.revoke
    capabilities:
      - Revoke
      - Audit
    planes:
      - Identity
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.plan.assign
    capabilities:
      - Bind
      - Audit
    planes:
      - Identity
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.update
    capabilities:
      - EditAny
      - Audit
    planes:
      - Identity
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.retire
    capabilities:
      - Archive
      - Audit
    planes:
      - Identity
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.reactivate
    capabilities:
      - Restore
      - Audit
    planes:
      - Identity
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.guardrail.read
    capabilities:
      - View
      - Audit
    planes:
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.guardrail.set
    capabilities:
      - EditAny
      - Audit
    planes:
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
caring_profiles:
  - caring-0.4.0-rc2
metadata:
  flex_auth_contract: protected-system-v0
  boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md