Platform model

Six nouns explain everything in Tanomis: platform, organization, tenant, agent version, session, run. You are the organization; your customers are the tenants. Here is how they nest, who works at each level, and what an operation changes.

How things nest

Your company is one organization. Each of your customers is a tenant: their own isolated runtime, with its own policy, connectors, sessions, and data, served by the agents you enable for them. An agent you deploy once can serve every customer, each on the version you choose. The platform underneath is Tanomis’s in the hosted service and yours in a self-hosted install; either way, it hosts your organization and runs the shared infrastructure.

Platformhosted by Cogward, or your own install · run by platform operators

Organization · Northwindyour company: your people, roles, grants, and automation credentials

bluewater-banktenant

• support-copilot0.2.0 canary
• invoice-reconciler1.4.1
• sessions → runs → evidence

orion-retailtenant

• support-copilot0.1.0
• invoice-reconciler1.4.1
• sessions → runs → evidence

helix-healthtenant

• support-copilot0.1.0
• invoice-reconciler1.4.0
• sessions → runs → evidence

support-copilota global agent: registered once, enabled per customer, each customer on the version you chooseglobal

1. AgentA stable name
2. VersionAn immutable build of it
3. EnablementWhich version this tenant serves
4. SessionA conversation or unit of work
5. RunOne request inside the session

Platform: shared infrastructure and global agentsOrganization: your company, its people and accessTenant: one customer, fully isolated

Need somewhere to test? Keep an internal tenant that serves no customer; a canary to one customer works the same way. Inside every tenant the runtime chain is the same: agent → version → enablement → session → run. An agent is a stable name. A version is an immutable build of it. An enablement says which version this tenant serves. A session is a conversation or unit of work against that version, and a run is one request inside the session. Files, approvals, and questions attach to the session; the audit ledger and trace record every run.

Who works where

Role	Level	What they do	Tool
Platform operator	Platform	Installs and upgrades Tanomis, provisions tenants, deploys global agents, sets tenant ceilings for models, egress, and connectors. Tanomis staff in the hosted service; your own team when self-hosted.	tanomis, Console
Organization owner or admin	Organization	Invites members, sets roles, grants tenants, creates automation credentials, reads the audit trail.	Console, tanomis
Developer	Tenant	Writes agents, deploys versions, canaries a new version to a few customers and rolls back, evaluates.	tanomis, CI
Your application	Tenant	Creates sessions and starts runs on behalf of a customer, in that customer’s tenant; streams events, answers approvals, attaches files.	Platform API
Reviewer or auditor	Tenant	Answers approvals in the Work queue, reads runs, exports evidence packages.	Console

The six nouns

Noun	What it is	Owned by	Changes when
Platform	One Tanomis deployment: shared infrastructure, global agents, and the operators who run it. Hosted by Tanomis, or installed by you.	Platform operators	You install or upgrade it.
Organization	Your company on Tanomis: its members, roles, tenant grants, and automation credentials. One per customer. Nothing runs here.	Your owners and admins	A member, role, or grant changes.
Tenant	One of your customers: an isolated runtime with the agents it serves, its policy ceilings, its connectors, and its data. Nothing is shared between tenants.	Your organization	Policy or enablement changes; offboarding destroys it.
Agent version	An immutable build of a named agent plus its declared contract. An enablement says which version a tenant serves.	Whoever deployed it	Never. A change is a new version; enablement moves traffic.
Session	A conversation or unit of work against one version in one tenant, with its workspace, files, and approvals. Suspended when idle.	Your application, or the person who opened it	Each run adds to it; it expires by idle or lifetime limit.
Run	One request inside a session, streamed as events, ending in one authoritative status. Every run leaves a ledger entry and a trace.	The session	Only its status, until it is terminal.

What changes what

You do	It creates or changes	Scope
tanomis agent deploy	A new immutable version, its warm-start snapshot, and an enablement.	The tenants named, or all with --scope global --tenants all
tanomis agent promote	The version’s global status only. No traffic moves.	Platform
tanomis agent enable or rollout	Which version a tenant serves, as baseline or canary share.	The tenants named
Change tenant policy	Ceilings for models, hosts, connectors, spend, for one customer. Applies to their next run.	One tenant
Grant or revoke a member	Who may see or act in a tenant. Takes effect on the next request.	Organization
Offboard a tenant	When a customer leaves: destroys their sessions, workspaces, and enablements. Ledger exports survive.	One tenant, confirmed by name

Where to go next

• Organizations and tenants: roles, grants, and how access is decided.
• Agents and versions: immutability, enablement, warm starts.
• Sessions and runs: the execution lifecycle.
• Identity and access: who asked, who acted, and how the API resolves a request.