tenancy

Module: config::tenancy

Contents

Structs

• TenancyConfig - Tenancy configuration.

Enums

• TenancyMode - Tenancy mode for the sidecar.

---

firma_sidecar::config::tenancy::TenancyConfig

Struct

Tenancy configuration.

Fields:

• mode: TenancyMode - Tenancy mode. Default: [TenancyMode::SingleAgent].

Trait Implementations:

• Default
  • fn default() -> TenancyConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> TenancyConfig

firma_sidecar::config::tenancy::TenancyMode

Enum

Tenancy mode for the sidecar.

SingleAgent (default): the sidecar serves exactly one agent_id for its entire lifetime. The first request to arrive establishes the bound agent_id; every subsequent request whose verified token claims a different agent_id is denied with DenyReason::TenantMismatch.

Why this exists

The sidecar holds per-session runtime state in an LRU (SessionStateStore) that Stage 2 (Cedar policy) reads to make decisions — for example, escalating risk when an agent suddenly issues many calls in a short window. If two agents shared one sidecar, agent A’s call count would be visible to agent B’s policy evaluation, letting one agent influence another’s enforcement outcomes. SingleAgent makes that partition structural instead of policy-driven, so it cannot be bypassed by a misconfigured Cedar rule.

Behavior

• First request to arrive: its verified agent_id is recorded as the bound agent. The request proceeds normally.
• Subsequent request with the same agent_id: proceeds normally.
• Subsequent request with a different agent_id: denied with DenyReason::TenantMismatch at the TokenValidation stage. The deny carries the presenting agent’s verified identity so the audit record is attributable.
• The bound is process-lifetime: a sidecar restart resets it.

Configuration

[tenancy]
mode = "single_agent"  # default; currently the only supported mode

Variants:

• SingleAgent - Single agent per sidecar process. The sidecar binds to the first

Traits: Eq

Trait Implementations:

• Default
  • fn default() -> TenancyMode
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• PartialEq
  • fn eq(self: &Self, other: &TenancyMode) -> bool
• Clone
  • fn clone(self: &Self) -> TenancyMode