| tenant | id | mssp | agents | tiers | branding |
|---|
tenant entity
A Tenant is the isolation/billing boundary — what an MSSP sells and what RBAC scopes to. Agents tagged to an id with no entity row still work (name falls back to the id). Re-parenting an existing Tenant between MSSPs is platform-only.
agents —
Each agent owns its backend, capability secret/keys, route policies and rate limit. Every action here is authorized against this Tenant's boundary server-side.
| agent | tier | site | backend | mode | keys | policies | rpm | brand |
|---|
api keys —
provision agent + backend
Mints the API key and capability secret (or an Ed25519 keypair for a partner/MSSP-run PEP). Raw material is shown ONCE — only the key hash and spec persist. The tenant field places the new agent under that Tenant's boundary (blank = standalone/legacy).
bulk provisioning (CSV import)
Columns: slug,tier,kind,url,rpm,customer,mssp,site,asymmetric (header row required; all but slug/url optional). customer is the parent Tenant — blank rows inherit the Tenant open above (if any). Each row is provisioned through the real API; the results file contains the minted credentials — it is the ONLY copy.
advanced: raw spec upsert
MSSP entities
An MSSP is a first-class entity (display name + metadata), not just a tag. A tenant tagged mssp=<id> with no entity still works — its name falls back to the id. The context switcher and tenant list show these names.
| id | display name | tenants | registered |
|---|
| pep_id | tenant | agent | site | region | status |
|---|
mint enrollment token
One-time token a headless PEP presents at /cp/enroll. Tenant XOR site; site tokens are owner-gated (multi_tenant licensing).
look up a subject's grant overrides
assign grants (per-subject override)
A stored row OVERRIDES the SSO role-map at the subject's next login. The list is a full replacement; an EMPTY list is an explicit deny. Delegation is ceiling-checked server-side — you cannot grant above your own role.
bulk grant assignment
One subject per line; every subject receives the SAME grant list built above. Partial failures are reported per subject.
mint a management session token
Bootstrap issuance seam (SSO owns this in steady state). Role/scope-bound, HMAC-signed, TTL-capped at 24 h. Shown once.
route policy —
Deny-by-default: a request must match a rule to acquire its required scope; no rule → deny. First match wins — order matters (put narrow rules above broad prefixes). Blank table = the built-in defaults.
| methods (comma-sep) | path prefix | required scope |
|---|
role-map builder
SSO is config-driven (bring-your-own-IdP: Okta / Entra / Google / WorkOS — any OIDC issuer; HS256 refused, PKCE on). Build the claims→grants role map here, then apply the generated environment to the control plane and restart. Per-subject overrides (Access tab) win over this map at login.
upload / rotate license (offline)
Paste or choose a Saluca-signed license JWT. It is verified OFFLINE against the pinned root key (classical Ed25519 or the PQC SG-HYBRID) BEFORE anything changes — an unverifiable license is rejected and the live tier is untouched. On success the entitlement gate hot-swaps with no restart. No phone-home.
central SIEM / alert export
Every PEP ships its signed audit chain to the control plane; from here the whole fleet's governed decisions export to your SIEM. Reconfigures live (no restart). The webhook auth / HEC token is WRITE-ONLY — set it here, it is never displayed back.
tenant white-label (default for all its agents)
Branding stored on the Tenant entity is the white-label default every agent under it inherits; agent-level overrides (below) win. Empty field = inherit the install brand.
per-agent white-label override
An agent-level override wins over its Tenant's branding, which wins over the install brand. Empty field = inherit.