UML data model: tenant isolation and durable records
Tenant isolation lives in the data model
UML associations: tenant-scoped keys, pinned versions, durable execution
Tenant
tenant_id: UUID [PK]
policy_epoch: long
quota_policy_id: UUID
Application
tenant_id + app_id [PK]
active_release_id: UUID
definition_version: long
Run
tenant_id + run_id [PK]
release_id: UUID [FK]
owner_epoch + status
DocumentRevision
tenant + source + entity
revision: long [PK part]
acl_revision: long
deleted + content_hash
Release
tenant_id + release_id [PK]
app_id: UUID [FK]
manifest_hash: string
immutable: true
Step
tenant + run + step [PK]
intent_hash: string
attempt + owner_epoch
result_ref: URI?
Evidence
tenant + evidence_id [PK]
source_revision: string?
tool_call_id: UUID? [FK]
interval + artifact_hash
ToolCall
tenant + operation_key [PK]
run_id + step_id [FK]
input_hash + state
external_status_ref: URI?
RunEvent
tenant + run + seq [PK]
step_id: UUID? [FK]
event_type: string
event_version: long
1 / 0..*
1 / 0..*
1 / 0..*
1 / 1..*
1 / 0..*
0..1 / 0..*
1 / 0..*
Step 1 / ToolCall 0..*
1 / 0..*
Every foreign key includes tenant_id. Evidence may also refer to queried telemetry.