Tenant and row scoping

Tenant scoping limits a request to the customer, account, or organization represented by the end user.

Configure the boundary

Mark the confirmed scoping field during source and catalog setup. Require organization scoping for any source that contains multiple customer tenants.

When an integration sends an X-Tenant-Id, Answerplane validates its format and permission before expensive planning or execution. A required but invalid scope is rejected.

Test isolation

Use two known tenants and verify:

1. each tenant sees its own rows
2. neither can retrieve the other's rows directly or through a join
3. missing and invalid scopes fail closed when scoping is required
4. charts, exports, embeds, and follow-up questions preserve the scope

Important distinction

Organization membership controls access to Answerplane resources. Tenant scoping controls rows inside a connected source. Many customer-facing products need both.

Never infer a tenant boundary from an unverified field name.