Multi-Tenant

Tenant isolation for agents, policies, audit trails, and scores. Registry-based tenant management.

Multi-tenant isolation ensures each organization gets a completely separate governance namespace. Agents, policies, audit trails, and scores are scoped to a single tenant with zero cross-tenant data leakage.

Tenant Registry

The registry manages tenant lifecycle and provides scoped storage for each tenant:

import { createMemoryTenantRegistry } from '@lua-ai-global/governance-enterprise';

const registry = createMemoryTenantRegistry();

const tenant = await registry.createTenant({
  id: 'org_acme',
  name: 'Acme Corp',
  slug: 'acme-corp',
  plan: 'pro',
  settings: { maxAgents: 50 },
});

const tenantStorage = registry.forTenant('org_acme');
// tenantStorage is a scoped GovernanceStorage instance

Tenant Operations

const tenant = await registry.getTenant('org_acme');
const tenantBySlug = await registry.getTenantBySlug('acme-corp');
const allTenants = await registry.listTenants();

await registry.updateTenant('org_acme', {
  plan: 'enterprise',
  settings: { maxAgents: 500 },
});

Scoped Storage

Each tenant gets a TenantStorage that extends the standard GovernanceStorage interface with tenant-specific queries:

const storage = registry.forTenant('org_acme');

// Standard GovernanceStorage methods — all scoped to this tenant
await storage.saveAgent(agent);
const agents = await storage.listAgents();
const events = await storage.queryAuditEvents({ agentId: 'my-agent' });

// Tenant-specific methods
const tenant = await storage.getTenant();
const teamAgents = await storage.listAgentsForTeam('engineering');
const auditEvents = await storage.queryTenantAuditEvents({
  since: '2026-03-01',
  severity: 'critical',
});

PostgreSQL Tenant Storage

For production, use the PostgreSQL-backed tenant storage:

import { createPostgresTenantStorage } from '@lua-ai-global/governance-enterprise';

const storage = await createPostgresTenantStorage({
  pool,
  tenantId: 'org_acme',
  tablePrefix: 'lua_gov_org_acme',
  autoMigrate: true,
});

Each tenant gets its own set of database tables, ensuring complete data isolation at the storage layer.

Creating a Governance Instance per Tenant

import { createGovernance } from 'governance-sdk';

const tenantStorage = registry.forTenant('org_acme');

const gov = createGovernance({
  storage: tenantStorage,
  rules: [
    blockTools(['shell_exec', 'db_drop']),
    requireApproval(['payment']),
  ],
});

// All operations are automatically scoped to org_acme
const agent = await gov.register({
  name: 'support-agent',
  framework: 'mastra',
  owner: 'cx-team',
  tools: ['ticket_update', 'knowledge_search'],
});

Bootstrap

For quick setup, use bootstrapEnterpriseTenant() which wires together multi-tenant storage, RBAC, analytics, incidents, and all other enterprise modules:

import { bootstrapEnterpriseTenant } from '@lua-ai-global/governance-enterprise';

const suite = await bootstrapEnterpriseTenant({
  tenantId: 'org_acme',
  tenantName: 'Acme Corp',
  storage: postgresStorage,
  adminUserId: 'user_alice',
});

// suite.gov       — governance instance
// suite.rbac      — RBAC guard
// suite.analytics — analytics engine
// suite.incidents — incident manager
// suite.webhooks  — webhook registry
// suite.anomaly   — anomaly detector