Provision a tenant

One transaction · 8 steps · six systems

Postgres, AI Search, Blob Storage, Azure DNS, the identity store and a mail transport share no transaction manager, so this runs as a saga with a persisted journal. Every step is idempotent and records what it created. If a step fails, the tenant stays SUSPENDED and serves nothing — and the run can be resumed from the failed step or rolled back.

The tenant

What will run

Rendered from the MRF descriptor against a placeholder slug. Steps marked one-way cannot be undone by a rollback, and each says why.

1. Reserve the tenant record

Create "Example Tenant" as slug example on edition MRF, SUSPENDED until provisioning completes.

REVERSIBLE
PLATFORM

2. Provision the edition database

Ensure eli_mrf_stag on psql-eliai-stag, then bootstrap this tenant's row and RLS grant inside it. The database is shared by every MRF tenant; the first tenant creates it and the rest adopt it.

One-way — the MRF database is shared by every tenant of the edition; only this tenant's row and grant are removed, never the database.

ONE-WAY
EDITION

3. Ensure the edition search index

Ensure index eli-mrf-stag on srch-eliai-stag (3072-dimension vectors, semantic ranking on). Shared per edition; tenant isolation inside it is a filter plus per-index RBAC.

One-way — the MRF index carries every tenant of the edition; unwinding one tenant must not empty it.

ONE-WAY
EDITION

4. Create the tenant storage container

Create tenant-example in stelimrfstag, retention 2555 days, under an immutability policy because this edition holds PHI.

REVERSIBLE
TENANT

5. Create the tenant DNS record

Point mrf-example.stag.eligrid.ai at the shared MRF front end. One label under stag.eligrid.ai — flat, so the wildcard already covers it.

REVERSIBLE
TENANT

6. Confirm certificate coverage

Assert mrf-example.stag.eligrid.ai is covered by *.stag.eligrid.ai. Nothing is issued: one wildcard covers every tenant, so provisioning never touches certificates.

One-way — nothing was created, so there is nothing to undo.

ONE-WAY
PLATFORM

7. Seed the first administrator

Create admin@example.com as TENANT_ADMIN, INVITED, with no password set.

REVERSIBLE
TENANT

8. Send the invitation

Invite admin@example.com to mrf-example.stag.eligrid.ai.

One-way — a delivered email cannot be recalled; removing the seeded user is what voids the invitation.

ONE-WAY
TENANT