Scope (Tenant Boundary)
A logical isolation boundary in a multi-tenant system. Permissions, roles, and access policies in one scope are completely independent from those in another.
A scope in WardenAuth is a tenant isolation boundary. Every permission, role, and access policy belongs to exactly one scope. Subjects' access in one scope is completely independent from their access in another scope.
Multi-tenant SaaS model
If you're building a B2B SaaS product, each of your customers typically gets their own scope. The scope ID is usually your customer's organization or workspace identifier:
// When customer "Acme Corp" signs up:
await createScope({ id: 'acme-corp', name: 'Acme Corp' })
// When evaluating access for a user in Acme's workspace:
{ subjectId: user.id, scopeId: 'acme-corp', resource: 'invoice', action: 'read' }Unlimited scopes
WardenAuth does not charge per scope. You can have one customer or ten thousand — the number of scopes doesn't affect your bill. Only the number of access checks (evaluations) matters for pricing.
Scope vs organization
WardenAuth distinguishes between your organization (your company, which holds billing and team members) and scopes (your customers' tenant workspaces). Your organization owns all your scopes. Your customers are isolated within their respective scopes.
Related terms
Authorization that evaluates permissions at the individual resource or action level, rather than broadly by user type or role.
A binding between a subject (user or service) and one or more roles within a scope. Defines what the subject can do in that tenant context.