# Tenant and catalog ownership

Nonfinal architecture review · 0.4.0. Generated from `assets/fixtures-security.js`; edit that source and rerun `node tools/generate-docs.js`.

Proposed — awaiting Jonathan’s acceptance. Accepted records are private unless an explicit publication grant is applied.

## recommendation

### label

PROP

### text

Recommend tenant-private catalogs from day one, with catalog identity separate from tenant identity. Awaiting Jonathan’s acceptance. Internal acceptance never grants public publication.

### why

Limits accidental disclosure and avoids imposing cross-tenant identity governance before real source behavior is known. A later shared catalog requires deliberate identity reconciliation.

## tenants

### id

ten_primary

### name

Primary tenant

### synthetic

false

### status

active

### catalogs

- cat_primary

### note

Fictional tenant fixture; private data is isolated by tenant and independently identified catalog.

### label

EST

### id

ten_synth_a

### name

Synthetic Tenant A (Quillfeather Test Goods, fictional)

### synthetic

true

### status

synthetic

### catalogs

- cat_synth_a

### note

Fictional tenant fixture; private data is isolated by tenant and independently identified catalog.

### label

PROP

### id

ten_synth_b

### name

Synthetic Tenant B (Mossgate Sample Supply, fictional)

### synthetic

true

### status

synthetic

### catalogs

- cat_synth_b

### note

Fictional tenant fixture; private data is isolated by tenant and independently identified catalog.

### label

PROP

## catalogs

### id

cat_primary

### name

Primary tenant private catalog

### owner

ten_primary

### holds

Tenant-private catalog items, definitions and accepted state

### writes

Resolver decisions within tenant scope; public release requires publications:write

### label

PROP

### id

cat_synth_a

### name

Synthetic Tenant A (Quillfeather Test Goods, fictional) private catalog

### owner

ten_synth_a

### holds

Tenant-private catalog items, definitions and accepted state

### writes

Resolver decisions within tenant scope; public release requires publications:write

### label

PROP

### id

cat_synth_b

### name

Synthetic Tenant B (Mossgate Sample Supply, fictional) private catalog

### owner

ten_synth_b

### holds

Tenant-private catalog items, definitions and accepted state

### writes

Resolver decisions within tenant scope; public release requires publications:write

### label

PROP

## rules

### area

Ownership

### rule

Tenant identity comes from verified credentials and server-side resource ownership.

### example

ten_primary / cat_primary

### label

PROP

### area

Catalog

### rule

Catalog identity is independent; every catalog has one tenant owner initially.

### example

ten_primary / cat_primary

### label

PROP

### area

Publication

### rule

Private accepted state is available only to authorized administrative or service callers.

### example

ten_primary / cat_primary

### label

PROP

### area

Identity

### rule

Public responses read an explicitly approved and applied release through an allowlist.

### example

ten_primary / cat_primary

### label

PROP

### area

Privacy

### rule

Shared catalogs with private overlays are a future alternative, not the current implementation slice.

### example

ten_primary / cat_primary

### label

PROP

## alternatives

### id

tenant_private

### name

Tenant-private catalogs — proposed start

### pros

Isolation and ownership explicit from day one.

### cons

Cross-tenant deduplication needs explicit future sharing.

### migrate To

Keep catalog identity separate; introduce reviewed shared references later.

### id

shared_overlay

### name

Shared catalog plus private overlays — future alternative

### pros

Share identity work across participating tenants.

### cons

Governance, publication, conflict and privacy policy required before sharing.

### migrate To

Explicit migration of ownership and every permission, event and projection scope.