Hi, We're looking to use Cerbos and Cerbos Hub to secure our multi-tenant application. I don't think that the multi-tenant samples I've found would be flexible enough for our needs (users can me members of multiple tenants and have different permissions in each) and so I'm currently exploring the "SaaS Analytics Workspaces" sample as an option. Couple of questions... • I guess firstly, is that a good idea for representing tenants rather than workspaces? What should I be weary of? • How would the principal workspaces object from the sample be represented in a schema? (highlighted red in the screenshot) I'm suffering from staring at a blank page so it would be good to get some basics sorted which we can build on. Thanks in advance.

Hi Oliver! Have you seen the multitenant SaaS demo (also available on the playground)? It has flexible cross-tenant role assignments where different tenants have different authorization requirements. Basically though, I think the idea of including tenant assignments on the principal object is sound. The only potential pitfall I can see is if that could grow to be very large (i.e. you have a huge number of tenants and some users can be individually assigned to most of them). To validate this sort of mapping object with a JSON schema, you can use

additionalProperties

to validate the values, possibly in combination with

propertyNames

(if you want to also validate the keys match the format of your IDs). For example,

{
  "$schema": "<https://json-schema.org/draft/2020-12/schema>",
  "type": "object",
  "properties": {
    "workspaces": {
      "type": "object",
      "propertyNames": {
        "pattern": "^[A-Z0-9]{12}$"
      },
      "additionalProperties": {
        "type": "object",
        "properties": {
          "role": {
            "type": "string",
            "enum": [
              "OWNER",
              "MEMBER"
            ]
          }
        },
        "required": [
          "role"
        ]
      }
    }
  },
  "required": [
    "workspaces"
  ]
}

You might not need an object in the values if you just need to map tenant ID to role.