Client Isolation, Roles & Runtime Enforcement
This page defines the backend hardening architecture required before AITP can scale from a private operator system into a controlled multi-tenant SaaS platform.
Client Isolation
- Tenant-specific client records
- Separated wallet/API configuration
- No cross-client portfolio visibility
- Tenant-scoped API responses
- Per-client runtime status
Role Permissions
- Client role
- Enterprise user role
- Corporate operator role
- Systems Studio admin role
- Owner-only infrastructure controls
Subscription Enforcement
- Subscription checked at login
- Expired clients blocked safely
- Past-due status displayed
- Billing status linked to dashboard access
- No manual access drift
Recommended Backend Boundary
Every backend request must be evaluated against tenant identity, authenticated user role, subscription state, and allowed capability. The client dashboard must never rely on frontend-only hiding of protected controls.
Audit Trails
- Login events
- Logout events
- Runtime control changes
- API key onboarding actions
- Billing/subscription events
- Admin/operator actions
Runtime Allocation Per Tenant
- Allowed trading pairs per tenant
- Capital allocation per client
- Max open positions per client
- Risk limits per tenant
- Profit-lock settings per tenant
- Runtime state isolation
API Hardening
- Backend role decorators
- Tenant-scoped database queries
- No client-side security assumptions
- Rate limits per tenant
- Request logging
- Credential vault separation
Client Edition Guardrails
Clients can view their own dashboard, portfolio state, subscription state, market data, and allowed runtime information only.
Enterprise Guardrails
Companies can access internal dashboards and users, but cannot create tenants, resell access, or access Systems Studio admin controls.
Corporate Guardrails
Corporate clients may receive custom infrastructure configuration, but platform ownership and owner/admin rights remain private.
Implementation Checklist
- Add tenant_id to all client data models
- Enforce tenant_id in every backend endpoint
- Add backend capability checks for every protected route
- Connect subscription status to authentication middleware
- Create immutable audit log table
- Separate admin, enterprise, corporate, and client capabilities
- Store API credentials in a tenant-specific vault structure
- Prevent dust balances from appearing as active positions
- Log runtime allocation and control changes per tenant
Backend hardening is mandatory before broad paid client access. Frontend role hiding is useful for UX, but platform security must be enforced server-side.