Tenant users
Tenant users are the people who interact with an agent through your product. They are distinct from platform users, who sign in to Caltra and administer the control plane. Organization membership grants a platform user access within an organization; it does not turn that platform user into a tenant identity.
Add a tenant user
- Open an organization in the Caltra operator app.
- Select Tenant users in the sidebar.
- Choose the workspace that will own the identity.
- Select Add tenant user and optionally enter the stable ID used by your application.
The external ID must be unique within that workspace. Leave it unset when you need an anonymous or not-yet-linked identity; do not invent a placeholder value.
External IDs
An external ID is your identifier, not a Caltra credential. Use a stable, opaque application ID such as usr_01J... instead of an email address when possible. That lets your application rename or update a user without changing the identity used for authorization and activity history.
Isolation behavior
Tenant-user reads and writes are scoped to both the active organization and the selected workspace. A workspace from another organization is rejected even if its identifier is supplied directly.
Caltra creates an authorization principal for each tenant user. Runtime access can then be granted to that principal without exposing administrator memberships or platform-wide credentials.