Multitenancy
How workspaces and environments stay isolated in PostgreSQL, OpenFGA and the authorization server.
A customer has a workspace, and a workspace has environments, for example production and staging. Everything that takes part in a decision belongs to one workspace and one environment: identity connections, agents, MCP servers, sources, permissions and relations. A call in one environment never sees data from another.
Isolation happens in three layers, and none depends on the others.
PostgreSQL. Business tables use Row-Level Security. Each transaction sets the workspace and environment, and the database returns only their rows. The backend runs with a restricted role, and the application refuses to start if that role can bypass RLS. A query bug in the code does not leak another customer's data, because the database does the filtering.
OpenFGA. Each environment has its own store, in a database dedicated to OpenFGA. The relations of one environment do not exist for another, and object identifiers need no customer prefix.
Authorization server. Each environment has its own issuer, signing keys and JWKS. A token issued for staging does not pass production validation, because the signature does not match.
The URL of an MCP call says which workspace, environment and server are the destination. It selects the scope but grants no access: the token must have been issued by that environment's issuer.