Tenancy & Governance

Tenancy, Roles & Members

tieback

is a multi-tenant platform. Every brand workspace is a fully isolated tenant: products, identifiers, passports, audit records, API credentials, and billing state belong to a single workspace, and that separation is enforced on every read and write.

Access Model

Access is workspace-scoped and role-based. Permissions are applied per action rather than granted wholesale, and the default posture is least privilege: a member can do what their responsibilities require and nothing more.

The model rests on four principles:

  • Workspace-scoped access. A member’s access applies only inside the workspaces they belong to.
  • Role-based permissions applied per action. Every read and write is authorised individually.
  • Least privilege by default. New members start with the narrowest access that fits their role.
  • Full separation between workspaces. No data, credential, or audit record crosses a workspace boundary.
  • An audit trail of who changed what. Every access change is recorded.

Roles span ownership, administration, editorial, and approval responsibilities. A workspace always has exactly one owner, and ownership transfer is atomic.

Member Management

Workspace owners and admins manage members from Settings → Roles:

  • Invite new members by email
  • Assign or change roles
  • Revoke access immediately
  • Transfer workspace ownership atomically (a workspace must always have exactly one owner)

Each member with at least one active role inside the workspace counts as a billable seat. Removing a member frees the seat immediately.

Platform Plane

A separate platform plane exists for tieback staff. Platform staff can:

  • Investigate and support customer workspaces with full audit logging
  • Manage carrier output profiles, market packs, and the field dictionary
  • Operate the support console for incident response

Platform staff never consume tenant seats. Their actions inside a tenant are logged distinctly from tenant-member actions and are subject to the no standing access policy: break-glass interventions require time-bound, cryptographically logged approvals.

Audit Log

Every role change, invitation, ownership transfer, and platform-staff intervention is recorded in the workspace audit log. See Audit Log.