How FlozentAi fits together · Docs

The levels

Level	What it represents	Who creates it
Workspace	Your company — the organization that bought FlozentAi	You, at sign-up
Application	One piece of software agents act inside	You, in the console
Environment	Development, staging or production of that application	You
Host tenant	One customer account inside your application	You, or your signup flow through the API
End user	One person inside a tenant	Created automatically on first sign-in

What is scoped to what

Applications and host tenants belong to a workspace and an application.

Environments belong to an application. Everything runtime-shaped hangs off an environment.

AI provider keys, runtime limits, trusted issuers, service accounts, deployments and tool bindings are all environment scoped — production can be configured completely differently from development.

Knowledge and run memory are tenant scoped, so one customer can never retrieve another customer’s content.

A request, end to end

Your backend mints a short-lived assertion

A JWT signed by an issuer you registered, carrying the end user’s subject and the tenant claim. It must live for 60 seconds or less.

It exchanges that assertion for scoped access

One call to the token exchange with your service account credentials and the assertion. You hold one service account, not one per user.

FlozentAi resolves the scope

It validates the issuer, maps the tenant claim to one of your bound tenants, then finds or creates the end user record for that subject.

The agent runs inside that scope

Effective permissions are the intersection of what was requested and what the service account was granted. A run can never exceed the grant.

Consequential actions pause

Anything the review marked as needing confirmation stops for a human before it touches your systems.

Loading…

The levels

Level	What it represents	Who creates it
Workspace	Your company — the organization that bought FlozentAi	You, at sign-up
Application	One piece of software agents act inside	You, in the console
Environment	Development, staging or production of that application	You
Host tenant	One customer account inside your application	You, or your signup flow through the API
End user	One person inside a tenant	Created automatically on first sign-in

What is scoped to what

Applications and host tenants belong to a workspace and an application.

Environments belong to an application. Everything runtime-shaped hangs off an environment.

AI provider keys, runtime limits, trusted issuers, service accounts, deployments and tool bindings are all environment scoped — production can be configured completely differently from development.

Knowledge and run memory are tenant scoped, so one customer can never retrieve another customer’s content.

A request, end to end

Your backend mints a short-lived assertion

A JWT signed by an issuer you registered, carrying the end user’s subject and the tenant claim. It must live for 60 seconds or less.

It exchanges that assertion for scoped access

One call to the token exchange with your service account credentials and the assertion. You hold one service account, not one per user.

FlozentAi resolves the scope

It validates the issuer, maps the tenant claim to one of your bound tenants, then finds or creates the end user record for that subject.

The agent runs inside that scope

Effective permissions are the intersection of what was requested and what the service account was granted. A run can never exceed the grant.

Consequential actions pause

Anything the review marked as needing confirmation stops for a human before it touches your systems.