Multi-tenant operations

StackTakt is built for operators who answer for more than one environment: a consulting firm serving many clients, or an in-house team running several isolated environments. The model is one organization, many tenants, each holding its own AWS accounts, people, deployments, and compliance posture.

Organization scope

The scope switcher moves between one tenant and the organization view, keeping you on the same section. Organization scope answers the cross-client questions without opening each tenant:

• Overview and Compliance: coverage and open drift findings across every tenant you can see.
• Billing: month-to-date spend per tenant, projections, and budget status side by side. Mixed currencies are never summed; each tenant’s own figure stands.
• Docs: which tenants have attestation documents to act on.
• Activity, Assets, Deploy: the same sections, rolled up.

Syncing a bill, setting a budget, and approving documents remain tenant actions: organization scope reads, tenants act.

Tenants are isolated

Every tenant-scoped record carries its tenant, every query filters by it, and cross-tenant access reads as not-found. Grants control who sees which tenants (see Users, groups, and grants); tenant groups let each client’s admins run their own people without reaching the organization directory.

One AWS account can serve more than one tenant: every bootstrapped resource (roles, stacks, buckets) carries a per-tenant slug, so a consultancy can reuse an account or migrate a client between tenants without name collisions.

Reuse without shortcuts

The repeatable parts of a compliance program are packaged, the accountable parts are not:

• Blueprints are the same for every tenant; each deployment asserts its own control snapshot in its own account.
• Policy packages capture one tenant’s completed attestation documents as a numbered version and apply them to a sibling tenant as drafts. Approvals never travel between tenants; each client’s named people approve their own documents. See Attestations and policy packages.
• Framework adoptions pin a catalog release per tenant, so one client’s matrix never shifts because another adopted later.