Multi-tenant Authorization

Tenant A (customer boundary)
└── Workspace
    └── Project (authorization configured here)
        ├── Production
        └── Staging

Tenant B (completely isolated)
└── Workspace
    └── Project
        ├── Production
        └── Staging

# Create Acme tenant
curl -X POST 'https://api.example.com/tenants' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -d '{
    "name": "Acme Corp",
    "slug": "acme-corp",
    "kind": "standard",
    "planKey": "pro",
    "maxUsers": 50
  }'

# Create Globex tenant
curl -X POST 'https://api.example.com/tenants' \
  -d '{
    "name": "Globex Inc",
    "slug": "globex-inc",
    "kind": "standard",
    "planKey": "pro",
    "maxUsers": 100
  }'

# Create workspace for Acme
curl -X POST 'https://api.example.com/workspaces' \
  -d '{"tenantId": "tenant_acme", "name": "Main"}'

# Create project
curl -X POST 'https://api.example.com/projects' \
  -d '{
    "tenantId": "tenant_acme",
    "workspaceId": "workspace_main",
    "name": "CRM Application"
  }'

# Create environments
curl -X POST 'https://api.example.com/environments' \
  -d '{"tenantId": "tenant_acme", "projectId": "project_crm", "name": "Production"}'

curl -X POST 'https://api.example.com/environments' \
  -d '{"tenantId": "tenant_acme", "projectId": "project_crm", "name": "Staging"}'

# Create roles for the CRM project
curl -X POST 'https://api.example.com/roles/batch' \
  -d '[
    {"name": "Admin", "description": "Full project access", "scopeId": "scope_project_crm"},
    {"name": "Sales Rep", "description": "Sales data access", "scopeId": "scope_project_crm"},
    {"name": "Viewer", "description": "Read only", "scopeId": "scope_project_crm"}
  ]'

# Create user via Management API
curl -X POST 'https://api.example.com/users' \
  -d '{
    "kindeId": "kp_acme_user_1",
    "email": "user@acme.com",
    "firstName": "Acme",
    "lastName": "User",
    "defaultTenantId": "tenant_acme"
  }'

# Add to project with a role
curl -X POST 'https://api.example.com/memberships' \
  -d '{"subjectId": "subject_acme_user", "scopeId": "scope_project_crm"}'

curl -X POST 'https://api.example.com/role-assignments' \
  -d '{"roleId": "role_sales_rep", "membershipId": "membership_acme_user_crm"}'

# This user has NO access to Globex tenant
# They can only access Acme's CRM project and its environments

// Acme user tries to access Globex project
const decision = await bedrock.evaluate({
  actor: { subjectId: "subject_acme_user", subjectType: "user" },
  scopeId: "scope_project_globex_crm",  // Different tenant!
  action: "read",
  resource: { resourceType: "customer" }
});

// Result: DENIED
// User has no membership in any Globex scope

# Create Acme's sales assistant agent
curl -X POST 'https://api.example.com/subjects' \
  -d '{
    "subjectType": "agent",
    "externalId": "acme-sales-assistant",
    "displayName": "Acme Sales Assistant",
    "meta": {"model": "claude-3", "purpose": "sales-support"}
  }'

# Add to Acme's CRM project only
curl -X POST 'https://api.example.com/memberships' \
  -d '{"subjectId": "subject_acme_agent", "scopeId": "scope_project_crm"}'

# Assign a restricted role
curl -X POST 'https://api.example.com/role-assignments' \
  -d '{"roleId": "role_viewer", "membershipId": "membership_agent_crm"}'

# This agent can ONLY access Acme's CRM project

// Agent acting on behalf of a sales rep
const decision = await bedrock.evaluate({
  actor: { subjectId: "subject_acme_agent", subjectType: "agent" },
  onBehalfOf: { subjectId: "subject_sales_rep", subjectType: "user" },
  scopeId: "scope_project_crm",
  action: "read",
  resource: { resourceType: "customer" }
});

// Both agent AND user must have the permission

# Create permissions at project level
curl -X POST 'https://api.example.com/permissions/batch' \
  -d '[
    {"scopeId": "scope_project_crm", "action": "read", "resourceType": "customer", "resourcePattern": "*", "key": "customer:read:*"},
    {"scopeId": "scope_project_crm", "action": "write", "resourceType": "customer", "resourcePattern": "*", "key": "customer:write:*"},
    {"scopeId": "scope_project_crm", "action": "delete", "resourceType": "customer", "resourcePattern": "*", "key": "customer:delete:*"},
    {"scopeId": "scope_project_crm", "action": "export", "resourceType": "report", "resourcePattern": "*", "key": "report:export:*"}
  ]'

# Disable delete in production environment
curl -X POST 'https://api.example.com/scope-overrides/permissions' \
  -d '{
    "childScopeId": "scope_env_production",
    "permissionId": "perm_delete",
    "state": "inactive"
  }'

# Only Admins can export in production
curl -X POST 'https://api.example.com/scope-overrides/role-permissions' \
  -d '{
    "childScopeId": "scope_env_production",
    "roleId": "role_sales_rep",
    "permissionId": "perm_export",
    "state": "revoke"
  }'

async function getUserProjects(subjectId: string, tenantId: string) {
  // Get all memberships for this subject
  const memberships = await fetch(
    `/memberships?subjectId=${subjectId}`
  );
  
  // Filter to projects within this tenant
  const projectMemberships = memberships.filter(m => 
    m.scopeId.startsWith('scope_project_') &&
    m.tenantId === tenantId
  );
  
  return projectMemberships.map(m => m.scopeId);
}

// Check access to a specific project
async function canAccessProject(subjectId: string, projectScopeId: string) {
  const decision = await bedrock.evaluate({
    actor: { subjectId, subjectType: "user" },
    scopeId: projectScopeId,
    action: "read",
    resource: { resourceType: "*" }
  });
  
  return decision.allowed;
}