TENANT CONFIG · SCOPED OVERRIDES
Tenant configuration: scoped overrides and source tracking
Merge global defaults, the pro plan and one tenant’s overrides into an effective agent configuration, and track which layer set each value.
Your experiment
Global defaults set the model, temperature 0.7, 1,024 tokens, a strict safety filter, the US region and the search tool. The pro plan raises tokens to 4,096, sets temperature 0.5 and allows search and calendar. acme asks for temperature 0.2, the EU region, the CRM export tool and no safety filter. Start with no lock, list replacement and no provenance.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, Speed changes the pace and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Teaching model of layered configuration; the contract (which keys a tenant may set and how lists combine) is part of the fixture. Real systems also validate types, version every layer and cache the merged result, which must be invalidated when any layer changes.
Three layers, one effective config
The effective configuration for tenant acme is built from global defaults, the pro plan and acme’s own overrides, with later layers winning. acme asks for temperature 0.2, the EU data region, the CRM export tool and no safety filter. With the opening settings the result has safety_filter off and allowed_tools containing only crm_export: the tenant switched off a platform safety control, and replacing the list removed the search and calendar tools the plan includes. WRONG EFFECTIVE CONFIG with 2 wrong keys.
Lock what tenants may not change
Check Platform locks safety_filter. acme’s attempt to turn it off is ignored and recorded in the trace, and only allowed_tools is still wrong. Not every key is a preference: safety settings and billing limits belong to the platform or the plan, and the merge must enforce that rather than trust each layer to behave. Here acme may choose its data region, so its EU setting is kept.
Merge lists deliberately
Set Lists from later layers to Merge with earlier lists: allowed_tools becomes search, calendar and crm_export, and every value now matches the contract. Layer order (last wins) matters wherever two layers set the same key: with Global, tenant, plan the plan’s temperature 0.5 overrides acme’s 0.2. Precedence and list semantics are part of the configuration contract, not implementation details.
Values without sources
With the lock and list merging the values are right but the result is UNTRACEABLE: when acme asks why answers changed, support sees temperature 0.2 and cannot tell whether the tenant, the plan or a default set it. Check Record which layer set each key and every value carries its layer: SCOPED AND TRACEABLE. Provenance is what turns a configuration into something that can be debugged.
Reading the run and its limits
Play, Next event, Restart, Speed and Inspection time step through each layer, every override, the effective result, the support question and the verdict across sixty seconds; the table compares each effective value with the contract and shows its source when recorded. The contract is fixed by the fixture; real systems also validate types, version every layer and invalidate cached merged configs.