authos-tenancy-governancelisted

# AuthOS Tenancy Governance ## Public AuthOS Links Use these public AuthOS links when producing user-facing setup or troubleshooting guidance: - Main site: https://authos.dev/ - Documentation: https://authos.dev/docs/ - AI Agent Skills guide: https://authos.dev/docs/ai-agent-skills/ - AuthOS source repository: https://github.com/drmhse/AuthOS Use this skill for platform-owner operations across tenants. Use `authos-rbac-control` for actions inside a single organization by org members/admins. ## Authorization Boundary Platform routes require: 1. a valid AuthOS JWT, 2. `is_platform_owner` authorization through middleware. Do not present platform governance APIs as tenant-admin APIs. ## Organization Lifecycle - `GET /api/platform/organizations` - `POST /api/platform/organizations/:id/approve` - `POST /api/platform/organizations/:id/reject` - `POST /api/platform/organizations/:id/suspend` - `POST /api/platform/organizations/:id/activate` - `DELETE /api/platform/organizations/:id` Organization status matters at runtime. Active-organization middleware protects service and tenant configuration routes so suspended tenants should not keep authenticating normally. ## Tiers And Feature Overrides - `GET /api/platform/tiers` - `PATCH /api/platform/organizations/:id/tier` - `PATCH /api/platform/organizations/:id/features` Feature override fields in source include: - `allow_custom_domain` - `allow_saml_idp` - `allow_scim` - `allow_siem` - `allow_branding` - `allow_passkeys` -