## Repo boundary

This repo owns **tenant-as-an-entity facts** only: tenant existence,
onboarding grouping, capability roles, plan/subscription assignment, and
(reserved) guardrail/quota policy. It does not own:

- Identity, authentication, MFA, token issuance → `key-cape` / Keycloak
- Tenant identifier format and role vocabulary → NetKingdom canon
  (`iam-profile_v0.3.md`, ADR-0013, ADR-0014) — this repo consumes it,
  never redefines it
- Users, profiles, memberships → `user-engine` (shared key: `tenant_id` only)
- Authorization decisions → `flex-auth` (this repo is a data source it
  queries, never the decision maker)
- Pricing-model / plan term definitions → `adaptive-pricing`
- Payment processing → not yet identified as owned by any repo
- Runtime secret custody → OpenBao / `secrets-engine`

Full contract: `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`.