Universal Tenant Model (UTM)

Every Cavaridge™ suite uses the same multi-tenant primitive: a shared tenants table, six tenant types, and three enforcement layers.

The 6 tenant types

Type	Hierarchy
platform	root
msp	child of platform
client	child of msp (or platform)
site	child of client
prospect	child of platform
individual	child of platform

Three enforcement layers

1. DB (RLS) — every tenant-scoped table has tenant_id FK + RLS policy via auth.tenant_visible().
2. API (middleware) — every route wraps in tenantGuard() from @cavaridge/auth/server.
3. UI (provider) — every customer-facing app wraps in <TenantProvider> from @cavaridge/auth/client.

Pitfalls

• Don’t define an app-local tenants table — always FK to the shared one.
• Don’t read tenant_id from request body — resolve via tenantGuard.
• Don’t bypass RLS in scripts unless verifiably-scoped.

Cross-references

• RBAC — the role layer above tenancy
• Multi-tenancy patterns — code examples