AppAccount multi-tenancy boundary
Model
A generated SaaS can host multiple internal customer organizations. These organizations are represented as AppAccounts. Their users and application data are scoped by AppAccountId.
Required behavior
- Runtime APIs derive the effective AppAccountId from authenticated identity/session context.
- Browser-posted tenant IDs are not trusted as authority.
- Record queries include tenant scope.
- Relation creation validates that both participating records are allowed within the same intended tenant/security boundary.
- RAG/vector retrieval includes tenant scope before context is returned to an AI model.
Distinction
A BuildWithHQ builder/customer account in the central control plane is not the same thing as an AppAccount inside one of that builder’s SaaS applications.