Across tenants
Portfolio
Runtime disconnectedWhat a partner may see across the merchants beneath them: authorized aggregates and nothing else. Opening an underlying merchant record is a separate, scoped grant that leaves an audit fact behind.
What this surface will govern
4- Only aggregates a grant explicitly authorises
- Opening one merchant's record requires its own grant
- Every opened record produces an audit fact
- Hierarchy is never, by itself, authorisation