Skip to main content

Overview

SaaS products need tenant-level data isolation. A missing tenantId means a data leak. Agentium provides TenantScopedStorage that transparently wraps any StorageDriver with tenant namespace prefixing.

Quick Start

Tenant-Scoped Storage

Wraps any StorageDriver to prefix all keys with the tenant ID:

Isolation Modes

Extracting Tenant ID

From Headers

From JWT Claims

Context Propagation

The tenantId flows through the entire request lifecycle:
  1. RunOptsagent.run(input, { tenantId: "acme" })
  2. RunContextctx.tenantId available in hooks and tools
  3. Storage → All reads/writes scoped automatically
  4. Eventstenant.scoped event emitted
  5. AudittenantId recorded in audit entries

Events