Documentation / Platform glossary / Tenant
A tenant is the boundary that owns a customer's data, users, and configuration within a shared platform. It is the unit that answers "which organization does this belong to" — and because every meaningful action happens inside exactly one tenant, that question always has a single answer.
A tenant usually corresponds to a customer organization, though not always one-to-one: a large enterprise may run separate tenants for distinct business units, regions, or a sandbox environment, precisely because a tenant is the boundary at which data and configuration are kept apart.
What belongs to a tenant is more than records. Users and their role assignments, configuration and settings, integration credentials, and audit history are all tenant-scoped. This is why a tenant is not simply a filter applied to shared data — it is the context that determines which data exists from a given caller's perspective.
The distinction from adjacent terms is worth keeping precise. A tenant is the boundary. Multi-tenancy is the architecture of serving many tenants from shared infrastructure. Tenant isolation is the guarantee that the boundary holds. Confusing the boundary with the guarantee is the most common source of imprecision when discussing separation.
Tenant identity is established at authentication rather than selected later, which is what allows an operator working across products to remain oriented and prevents an action from landing in the wrong customer environment.
The tenant is the anchor for nearly every other control. Access decisions, audit scope, retention, and data residency all reference it, so a system with a weak or inconsistent tenant concept cannot express those controls coherently regardless of how it implements them individually.
It is also the practical basis for answering customer questions. "Show me everything about our organization" is tractable only when a boundary defines what "our organization" covers.
QueryTek treats the tenant as the primary workspace boundary across Review, Tapestry, and EBM. Authentication resolves to a tenant, and access, audit records, and retention are scoped to it. Enforcement mechanics are not published.
