SHAIP Multi-Tenant Operator Dashboard

disconnected
Gateway connection  (click to toggle)
JWTs live in the browser only — never sent anywhere except the gateway.
Paste both tenants' JWTs above and click Connect. JWTs are obtained via the Okta M2M client-credentials grant — the provision_tenant.py output bundle in Secrets Manager holds the client_id + client_secret needed.

Five-layer isolation evidence

Static map from docs/multi-tenant-readiness.md. Each layer's status badge updates when the corresponding live probe in the cross-tenant section below fires.

  1. untested L1 — Identity Okta server-stamps tenant_id; JWT signature + iss + aud + exp verified at the authorizer
  2. untested L2 — Authz read STS-tagged session + DDB ResourcePolicy with dynamodb:LeadingKeys
  3. untested L3 — Agent registry owner_tenant_id filter — tenants see only their own + _platform-shared agents
  4. untested L4 — Tool calls tenant_injector REQUEST interceptor injects tenant_id into every tool argument
  5. untested L5 — Audit Every audit row carries tenant_id; S3 Object Lock COMPLIANCE retention

Cross-tenant denial probes

Live probes against the deployed gateway. Each row asserts the cross-tenant invariant — Acme cannot read Globex's resources. All must report PASS for the multi-tenant guarantee to hold.

LayerProbeExpectedGotResult
Run Run isolation probes to populate.