Every account, case, payment and document belongs to a debt book, which belongs to a client entity, which belongs to a tenant. Nothing skips a level, and nothing crosses a tenant boundary.
Every login, every API key, every debtor record sits under exactly one tenant. The active-tenant context is checked on every request — a tenant ID supplied by a browser or API client is never, on its own, enough to reach another tenant's data. An invalid or unassigned tenant returns HTTP 403, with no silent fallback to global data.
A tenant can hold one client entity (a municipality collecting on its own book) or several (an agency serving multiple municipalities). Each client entity's debtors, reports and communications stay separated from every other entity in the same tenant.
Each debt book belongs to one client entity and one tenant. Existing import functionality carries over unchanged — debt books are additive structure on top of the ingestion pipeline, not a rebuild of it.
A normal tenant user cannot reach another tenant's debtors, accounts, cases, payments, documents, communications, reports, imports, AI data or audit records. PLATFORM_SUPERADMIN may explicitly select any tenant; a tenant user may select only their assigned tenants; if a user has one tenant, it becomes the default automatically.
