Multi-Tenant Organization Agents

[!NOTE] Status: Preview. Organization tenancy and attribution plumbing are defined and undergoing phased rollout. Gated behind the OMNI_ORGS_ENABLED feature flag.

Organizations enable enterprise teams to share agent knowledge, collaborate on workspace documents, and centrally manage billing.

Namespace Partitioning

Organization workspaces reside strictly under dedicated path prefixes:

orgs/<orgId>/workspaces/<workspaceId>/

• Access is validated per request against the D1 organization registry (core-config).
• Non-members receive 403 Forbidden.

Dual Billing Attribution (resolveBillTo)

Omni resolves billing attribution on every request using a deterministic server-side function:

resolveBillTo(orgId, actorUid):
  if actor has active paid subscription:
    return bill_to = actorUid (Model B: Member-Funded)
  else if actor is an active member and org owner is in good standing:
    return bill_to = orgOwnerUid (Model A: Seat-Funded)
  else:
    deny request with 402/403 reason code

Attribution Models

Org-Bound API Keys

Developer API keys can be bound to a specific orgId. When verified, the key inherits organization authorization and bills directly to the organization owner principal.