tenancy.treeModule 18Model resellers and their customers as a tree, and compute who can reach each branch from delegations instead of storing it.
tenancy.tree is the sub-tenant tree and the delegations on it. A tenant hangs off one parent, a principal holds read, operate or administer over a branch, and reach is worked out by walking the tree on every call. Suspending a tenant or revoking a delegation cuts everything beneath it.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseThe tree answers can and reach, but no other module calls them, so a delegation does not yet limit what agents or consoles do. Use the answers in your own tooling and treat enforcement as not wired.
Plane module
tenantsid, name, parentId, createdAt and, when suspended, suspendedAt.path
/ valid{ ok: true }, or { ok: false, reasons } for a duplicate id, a missing parent or a cycle.delegationsdelegations route: each grant with principal, tenantId, scope, canDelegate and grantedBy.revokedAtrevokedWhy.create adds a tenant under a parent, or at the top for the workspace's administrators. move re-parents a subtree. A cycle is refused.
delegate gives a principal read, operate or administer over a tenant and everything under it. canDelegate is a separate flag, never implied by the scope.
reach and can walk the tree and the live delegations to say what a principal holds. Nothing is stamped on rows, so a move or a revoke takes effect at once.
suspend cuts reach to the tenant's whole subtree, and lift: true restores it. revoke ends a delegation and every delegation carved out of it.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. tenancy.tree docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
GET /api/v1/acp/tenancy/tree Authorization: Bearer av_workspace_•••• → 200 { tenants, valid }
{
"tenants": [
{
"id": "tenant_1a",
"name": "Acme MSP",
"parentId": null,
"createdAt": "2026-10-12T10:00:00.000Z",
"path": "Acme MSP"
},
{
"id": "tenant_2b",
"name": "Superfly",
"parentId": "tenant_1a",
"createdAt": "2026-10-12T10:05:00.000Z",
"path": "Acme MSP / Superfly"
}
],
"valid": {
"ok": true
}
}A reseller gets administer over its own tenant with canDelegate, and appoints an operator for one customer. It cannot grant more than it holds.
suspend a customer tenant to cut reach to it and everything under it. Lifting the suspension restores it; nothing was deleted.
revoke a delegation and every delegation carved out of it ends with it. The answer lists the tenants left with no live delegation.
can answers whether a principal holds operate over a tenant, and reach lists every tenant a principal can touch.
coordination.admit.tenancy/revoke needs a two-administrator warrant; see dual-control.scopes.identity.enroll.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
canDelegate is set.create and move refuse a cycle.grantedBy; a revocation keeps its time and reason but not who revoked, and moves keep no actor.read < operate < administer, each including the one before. Re-delegation is the separate canDelegate flag, so a reseller can appoint operators without becoming an administrator.
The workspace's owners and admins hold the root, and may name root-admin principals. A delegate with canDelegate can create sub-tenants and delegate beneath its own reach. Only the root creates top-level tenants.
revoke needs a dual-control warrant for the scope revoke-tenant, and is then checked against who granted the delegation or holds the one it came from.
scope defaults to operate when delegate omits it.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/tenancy/treeRead the tenant tree, or one subtree, with paths./api/v1/acp/tenancy/createCreate a tenant under a parent or at the top./api/v1/acp/tenancy/suspendSuspend a tenant and its subtree, or lift the suspension./api/v1/acp/tenancy/delegateGive a principal a scope over a tenant./api/v1/acp/tenancy/revokeRevoke a delegation and everything carved from it./api/v1/acp/tenancy/delegationsList delegations, filtered by tenant, principal or live./api/v1/acp/tenancy/reachList what scope a principal holds over each tenant./api/v1/acp/tenancy/canAsk whether a principal holds at least a given scope.This module has no MCP action. Call it over REST from any agent or program.
dual-control.scopes22Two-person dual controlRequire two different administrators before the plane's most destructive actions run, and see whether the break-glass seal is intact.identity.enroll12Agent identity registryGive each agent its own identity before it acts, so every admitted action traces back to one agent and never to a shared account.coordination.fleetmap11Fleet MapRead every agent grant, lease, waiter and quarantine in the workspace in one call, drawn from what the plane has admitted.mcp.shadow13Shadow agent discoveryList the tool calls the MCP gateway has seen, with the agent behind each, so callers nobody enrolled show up beside the ones that are.civics.presence14Agent presenceLet agents see which peers are online and what each holds, so a quiet agent is not mistaken for a hostile one.trust.get15