Tenant isolation¶
RG enforces tenant isolation where it actually matters: at the query, audit, and resource-allocation layers, not in the UI. An organization can only ever reach its own resources, and a lookup for another tenant's resource returns "not found" rather than "forbidden", so a caller cannot even confirm that resource exists (a credential presented against an organization it is not scoped to is a separate case, refused as "forbidden"). Isolation is a property of data access, not a screen that hides things.
Enforced below the UI¶
Hiding resources in the interface is not isolation — it leaves the data reachable to anyone who bypasses the UI. RG enforces separation at the layers that serve data. At the query layer, every lookup is scoped to the caller's tenant, so a query can only return that tenant's rows. At the resource-allocation layer, allocations — tunnel endpoints, identifiers, capacity — are partitioned by tenant, so one tenant's resources are never drawn from or visible in another's pool. At the audit layer, records are tenant-scoped, so an organization sees only its own audit. Because enforcement lives beneath every access path, there is no route — API, tool, or UI — that returns another tenant's data, regardless of how a caller constructs the request.
Enumeration-resistant "not found"¶
A cross-tenant resource lookup in RG returns "not found" rather than "forbidden". The distinction is a deliberate defense: "forbidden" confirms that a resource exists and is merely off-limits, which lets an attacker enumerate valid identifiers by watching which ones return "forbidden" versus "not found". By returning "not found" for any resource outside the caller's tenant — whether it truly doesn't exist or simply belongs to someone else — the platform reveals nothing about other tenants' inventory. (Presenting a credential against an organization it is not scoped to is the separate case, refused as "forbidden", since that response reveals nothing about any specific resource.) A caller cannot tell an absent identifier from one owned by another organization, so probing yields no map of what exists. This turns isolation from a visibility rule into an information-theoretic one.