Tenancy and Permissions¶
Last verified: 2026-07-26 against current checkout c09254f.
DocGen is organization-scoped. An organization represents one client engagement or demo solution. Every persisted template/document row belongs to an organization.
Tenancy Model¶
| Concept | Rule |
|---|---|
| Organization | Owns templates, instances, tools, texts, snippets, gathered data, and generated output. |
| Active org | Resolved per request from the app/API context. Local non-HTTP paths can fall back to env-driven org selection. |
| Template specs | Assigned to orgs through seeding configuration. |
| Tools | Registered per organization; tool code is shared, tool availability/config is scoped. |
| Documents | Templates and instances are org-owned; instances are snapshot copies, not live references. |
Permissions Surfaces¶
- The demo/development app has local auth and org-switching behavior documented in the root README and demo reference.
- MCP per-user authorization is documented separately because it forwards end-user identity to source servers.
- Production auth posture is controlled by the app/service layer, not by raw template specs.
Hard Rules¶
- Do not store source credentials in DocGen database rows or specs.
- Do not use a process-global active organization for request handling.
- Do not bypass the public API for normal authoring flows.
- Do not expose a user's source-system data to another organization or user.