Skip to main content
AgentFlow supports single-tenant and multi-tenant deployments with the same runtime model. Authentication resolves a tenant from the bearer token, M2M headers, or local dev configuration, then AgentFlow binds the request to isolated tenant resources.
For the bearer-token, M2M, and local development auth contract, see Authentication.

​
What’s Isolated

ResourceIsolation Level
DatabaseSeparate storage per tenant
Tool registryPer-tenant tool assignments and state
LLM configPer-tenant model, temperature, token limits
Knowledge basesTenant-scoped documents and embeddings
ConversationsTenant-scoped history

​
How It Works

Tenant context is extracted from the configured Auth0 tenant claim, the validated M2M tenant claim plus snc-tenant header, or DEV_TENANT_NAME in local bypass mode. The runtime uses that tenant to select the database, tool assignments, knowledge bases, cached results, artifacts, prompt configuration, and user memory for the request. For a single-tenant deployment, every valid token resolves to the same tenant database. For a multi-tenant deployment, each valid tenant key maps to a separate tenant database.

​
Machine Tenant Context

Machine-token requests carry tenant context in two places:
SourceRequirement
Token tenant claimMust exist and pass tenant-name validation.
snc-tenant headerMust be present and match the token tenant claim.
snc-userid headerMust be present for acting-user attribution.
This prevents a service token for one tenant from being replayed against another tenant by changing only a request header.

​
Tenant Provisioning

When a new tenant is first seen, AgentFlow automatically:
  1. Creates the tenant’s storage
  2. Runs any necessary setup
  3. Initializes default agent configurations

​
Per-Tenant LLM Configuration

Each tenant can override default LLM settings: 
curl -X PATCH https://api.example.com/api/v1/settings/llm \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-token>" \
  -d '{
    "default_model": "anthropic/claude-sonnet-4-20250514",
    "default_temperature": 0.8,
    "default_max_tokens": 8192
  }'
This affects all agents for that tenant unless an agent has its own explicit llm_config.