Skip to main content

Tenant scope and immutable science

Every request is bound to an organization, app, and environment. Every result is bound to immutable definition versions.

Tenant hierarchy

Organization

The company and membership boundary. Roles include owner, admin, builder, developer, analyst, and viewer.

App

One product or use case, such as Savart EFG or a customer onboarding journey. Scores are meaningful only inside their app.

Environment

Every app has isolated test and live environments with separate subjects, keys, programs, webhooks, quotas, and analytics.

Subject

Your app’s end user. The public ID is opaque; external identifiers and PII live in a separate encrypted identity vault.
Scope comes from the credential. Never accept organization, app, or environment scope from an untrusted browser and pair it with a broad key. The environment key or human session is authoritative.

From definitions to results

Lifecycle rules

  • Definitions move through draft → validated → published → deprecated → archived.
  • Published versions never mutate; edit by creating a new draft revision.
  • Live environments begin in managed review and accept mutations only after platform approval.
  • Hard guardrails stay authoritative. An LLM cannot improvise questions or change scoring during an evaluation.
  • Context precedence is organization → app → program → subject/session, and every merged fingerprint is stored with the result.

Credential roles

Human owners and admins publish science and activate programs. admin/ops environment keys run trusted server integrations. ingest keys are restricted to subject import and continuous-evaluation host writes. Participant and report tokens grant access to exactly one public journey or report.