Multitenancy

The ConfidentialMind stack provides multitenancy to segregate users and resources within tenant boundaries. This allows organizations to maintain separate environments for different teams, departments, or clients while sharing the same platform infrastructure.

How Multitenancy Works

• Base tenant segregation: Every user is under at least one tenant
• Single active tenant: Only one tenant is active in portal UI at a time
• Deployment isolation: All deployments are under a specific tenant
• Sub-group organization: Tenants can have sub-groups for sharing deployments and structuring user separation
• Scoped visibility: You only see users/groups in the same tenant when sharing services
• Tenant administration: Tenant admins see all services in the tenant and can manage sub-groups and deployment access

User Levels

Regular Users

• Can join tenants through invitations
• Can create one personal tenant
• Can switch between tenants they belong to
• Can deploy services within their selected tenant

Tenant Administrators

• Have admin privileges within their specific tenant
• Can invite users and manage tenant membership
• Can create and manage sub-groups
• Can control service access and permissions within their tenant

System Administrators (Tenant-Admins)

• Can create and delete any tenant
• Can join or leave any tenant as an administrator
• Have cross-tenant management capabilities
• Can view system-wide tenant statistics

Groups

Groups are sub-divisions within tenants that allow for more granular organization and access control:

• Members group: Default group containing all tenant users
• Admins group: Contains tenant administrators with elevated privileges
• Sub groups: Created by tenant administrators for organizing teams or projects
• Groups can be assigned different permission levels (view or admin) to specific services
• Users can belong to multiple groups within a tenant

Using Multitenancy in the Platform

Joining Tenants via Invitations

When you receive a tenant invitation:

1. When logging in to the portal you will be displayed if any pending invitations exist
2. Click Accept or Reject for each invitation

Creating a Personal Tenant

If you haven't been invited to a tenant, you can instead create your own personal tenant.

1. When signing in, if you don't have a current tenant or any invitations you will see:
2. Select Create tenant
3. Enter a tenant name (letters, numbers and underscores only)
4. Click Create
5. You'll become the administrator of your personal tenant

Switching Between Tenants

If you belong to multiple tenants, you can switch between them:

1. Click your profile menu in the top right
2. Select Switch tenant
3. Choose your desired tenant from the list
4. The platform will update to show only resources from the selected tenant, with (admin) shown for tenants where you are an admin

Service Permission Management

For any individual service, you can control who has access and at what level:

Access service permissions:

1. Navigate to your specific service page
2. Click on the User access tab
3. Toggle between Users or Groups mode

Assign permissions to users:

• User search shows only users within your tenant
• Choose Admins or Users column and add users as needed

Assign permissions to groups:

• Users see only groups they belong to
• Tenant administrators see all groups in the tenant
• Available options include:
  • Custom groups: Your tenant's sub-groups
  • Tenant Members: Gives all users in your tenant access to the service
  • Tenant Admins: Gives all admins in your tenant access to the service
• Choose Admins or Viewers/Users column and add groups as needed

Permission levels:

• Admin: Full control over the service including configuration and user management
• View: Read-only access to use the service

Managing Your Tenant (Tenant Administrators)

Access tenant management by clicking Manage tenant in your profile menu when hovering the email.

The management interface has three main sections:

Users Tab

• Search users by name, email, or group
• View admin and member user tables separately as well as all members' subgroups
• Click user groups to jump to the Groups tab

Invite new users:

1. Click Invite User
2. Enter the user's email address
3. Click Send Invitation
4. What happens after invitation:
   • Existing users: Simply sign in to the portal and accept the invitation from the popup
   • New users: Will receive an email to set a password for their new account, then can accept the invitation after signing in
5. Track invitation status (pending, accepted, rejected)

Manage individual user groups:

• View which subgroups a user belongs to in their user entry's Groups column
• Click the + icon next to a user to modify their group memberships
• Note: Removing a user from the Members group will remove them from the tenant entirely

Remove users:

1. Find the user in the admin or members table
2. Click the remove button
3. Confirm the removal

Alternatively, remove the members group using the above method

Groups Tab

• Search groups by name
• See member counts on group cards
• Click group cards to manage members

Create new groups:

1. Click Create Group
2. Enter group name (letters, numbers, underscores only)
3. Click Create

Manage group members:

1. Click on a group card
2. Search and add users to the group
3. Remove users from the group as needed

Services Tab

• Search services by name, ID, type, or assigned groups
• See which groups have access to each service
• Click + to manage individual service permissions for groups and users

Manage user deployment limits:

• Configure limits for how many services users can deploy
• Set limits by service type as a total for all services in the tenancy
• 0 equals deployment of service type disabled for tenant members

Tenant Admin Panel (System Administrators)

System administrators with tenant-admin privileges can access cross-tenant management functions to oversee all tenants in the system. The panel provides tenant statistics, creation and deletion capabilities, and the ability to join any tenant for management purposes.

Access the tenant admin panel:

1. Click your profile menu in the top right
2. Select Tenant Admin Panel

Create new tenants:

1. Click Create tenant
2. Enter tenant name (letters, numbers, underscores only)
3. Click Create
4. You'll automatically become an administrator of the new tenant

Join existing tenants:

1. Find the desired tenant in the list
2. Click Join tenant
3. You'll be added as an administrator without requiring an invitation
4. Switch to the tenant context to begin management
5. When done leave the tenant with Leave tenant

Delete tenants:

1. Locate the tenant you want to remove
2. Click Delete tenant
3. Confirm the deletion in the dialog
4. All tenant resources and data will be permanently removed