19 lines
910 B
Markdown
19 lines
910 B
Markdown
|
## Repo boundary
|
||
|
|
|
||
|
|
This repo owns **tenant-as-an-entity facts** only: tenant existence,
|
||
|
|
onboarding grouping, capability roles, plan/subscription assignment, and
|
||
|
|
(reserved) guardrail/quota policy. It does not own:
|
||
|
|
|
||
|
|
- Identity, authentication, MFA, token issuance → `key-cape` / Keycloak
|
||
|
|
- Tenant identifier format and role vocabulary → NetKingdom canon
|
||
|
|
(`iam-profile_v0.3.md`, ADR-0013, ADR-0014) — this repo consumes it,
|
||
|
|
never redefines it
|
||
|
|
- Users, profiles, memberships → `user-engine` (shared key: `tenant_id` only)
|
||
|
|
- Authorization decisions → `flex-auth` (this repo is a data source it
|
||
|
|
queries, never the decision maker)
|
||
|
|
- Pricing-model / plan term definitions → `adaptive-pricing`
|
||
|
|
- Payment processing → not yet identified as owned by any repo
|
||
|
|
- Runtime secret custody → OpenBao / `secrets-engine`
|
||
|
|
|
||
|
|
Full contract: `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`.
|