With or without tenants
During assembly you decide whether your system has tenants. Without tenants there is a single database – suitable for systems with one customer. With tenants, every tenant gets its own database and every request is checked against its tenant.
By design, a tenant has no parent or child tenants. Any hierarchy would raise security questions: does a suspension also apply to the subsidiaries? Does the parent see their data? For a holding with subsidiaries there are clear answers: separate tenants if the data should stay apart, or one tenant with groups for shared role bundles.
Static or dynamic
A static tenant is assigned to the person directly on their account. A dynamic tenant is kept by your identity provider as an organisation; a person can be a member of several organisations and hold different roles in each. In business terms a customer is a customer either way – the type only determines how membership is carried.
Every request under exactly one tenant
Before a module sees a request, CIAS determines the tenant. If the situation is ambiguous, the request is refused – there is no default tenant for CIAS to fall back on. No answer is better than the wrong customer’s data.
The tenant gate then checks whether the tenant may work today: it has to be active, and today’s date has to lie within its validity window. An unknown tenant and a suspended tenant look the same from outside. Background work such as timers and jobs passes through the same gate.
A traceable life cycle
CIAS separates a tenant’s business standing from its technical set-up. That way “suspended because of an unpaid invoice” never looks like “half set up”.
- Creating happens in steps: record the intent, set up the database, record the result. If set-up fails, a recognisably unfinished tenant remains that can be set up again.
- Suspending and resuming for temporary interruptions – data and accounts stay unchanged.
- Closing for the final end. There is no deletion.
- A validity window defines from when and until when a tenant is served.
- The tenant key is set once and never changes; people see a display name.
Switching between tenants
Someone who is a member of several tenants selects the tenant of a request and holds the roles of their membership there. Switching into a tenant without one’s own membership requires a dedicated platform role and only works for permitted tenants. After every switch, the tenant gate checks again – now for the target.