dsh-multi-tenant

Multi-tenant SaaS extension for DeepSeek Harness (DSH): tenant identity, session ownership, authorization boundaries, tenant-aware MCP, and audit.

Status: early development / architecture bootstrap. This repository establishes the plugin skeleton and the multi-tenant core abstractions. It is not yet a production security boundary — see Security boundary.

---

What this is

dsh-multi-tenant is a Cordis plugin for DeepSeek Harness that provides a single service, ctx.multiTenant, which owns the mapping between DSH sessions and the tenant/user that may access them. The goal is to let one shared Harness runtime host many tenants with logical isolation — without forking Harness and without patching node_modules.

This first milestone ships only the core: identity types, session ownership, and fail-closed authorization. Everything else is on the roadmap.

Architecture

Browser / SaaS client
        |
        | authenticated identity
        v
Tenant-aware connection / API boundary
        |
        | TenantPrincipal
        v
Session authorization
        |
        +---------------------+
        |                     |
        v                     v
Shared DeepSeek Harness   Tenant-aware MCP
Agent Loop / LLM / Tools  credential pool
        |
        v
Session persistence
        |
        v
Audit / usage store

Design principles

• Shared runtime, logical isolation — one Harness process, many tenants, separated by authorization rather than by process or fork.
• Fail closed — unknown sessions and unauthenticated identities are denied by default.
• Identity is server-derived — a TenantPrincipal comes from the authenticated request boundary, never from a client-supplied field.
• Explicit session ownership — every session has one recorded owner; access requires matching that owner (or a future elevated role).
• Streams are authorization surfaces — sessions, RPC, and tool/MCP streams are each an authorization boundary, not just the HTTP entry point.
• Tenant-aware tool execution — tool and MCP access is scoped per tenant.
• Defense in depth — this plugin is one layer; it does not replace the authenticated boundary or downstream tenant validation.