Tenancy & residency
How a tenant is isolated, how a residency pin is enforced on every authenticated request, and exactly what an operator can and cannot see.
What is shared and what is not
The market plane, meaning the contagion graph, the extracted edges and the public labels, is shared by reference, because it is identical for everyone and duplicating it would mean tenants disagreeing about mainnet. Everything that is a customer record is per-tenant and never shared: agent fleets, incidents, runbooks, operator keys, simulations.
Residency is enforced, not promised
A residency pin is a tenant property checked at the API boundary on every authenticated request. If a tenant has no pin, onboarding says so out loud rather than letting an unenforced commitment sit in a contract, because an unenforced residency clause is worse than none at all, because it is relied upon.
Operator visibility
Operators provision tenants and qualify address sets. The audit log records which principal did what, and OIDC principals name the person rather than a key id.
Where the boundary sits.
In the same type as everything above it, and paired with the control that covers it. This is the part your auditor reads first.
Put Tenancy & residency on your perimeter.
Engine-level detail and the full catalogue are provisioned with your engagement, alongside the console your team works in.