← Help home

Tenants, roles, and scope

Last reviewed: 2026-04-27 · Owner: Product & Engineering

The dev console defaults the session actor to platform_admin. Use Home → Session actor to switch to tenant_admin if you are validating the role-gated sections on this page.

Goal

Use the correct tenant scope and headers so reads and mutations align with SPEC-001 RBAC.

Prerequisites

  • Actor id and role available to the admin API (dev console uses X-Actor-* headers).
  • For tenant_admin, a non-empty X-Actor-Tenant-Id matching your integration (e.g. tenant_alpha).

Not available for your role: Creating or deprovisioning the canonical tenant record in Tapestry is reserved for platform_admin. Contact your platform operator if you need a new tenant identifier or org onboarding.

Steps (tenant admin)

  1. Confirm your session carries the tenant id you operate (see Session actor panel in dev).
  2. Retry API calls with corrected headers if you receive 403 scope errors.
  3. Never reuse another tenant’s identifiers in examples—keep samples synthetic.

Verify

  • List partners for tenant_alpha succeeds when role and tenant headers match.
  • Mutations that require finance or platform roles are refused with explicit errors, not silent success.

If it fails

Check role spelling, tenant id typos, and whether the operation is finance-gated. Escalate to platform ops for tenant lifecycle outside your scope.

Further reading