Tenants

Every resource in Asiri belongs to exactly one workspace — our term for a tenant. A workspace is the unit of billing, access control, audit, and data isolation: API keys, subjects, requests, consents, audit entries, and webhook endpoints all carry a workspace_id. Cross-workspace access is impossible by construction — see Row-Level Security for the database-layer enforcement.

The deeper reasoning for data residency, soft-delete semantics, and shared-schema multi-tenancy is captured in the Compliance Ontology architecture decision.