# Authos Tenancy Governance

> Govern AuthOS tenant organizations as a platform owner. Use when approving, rejecting, suspending, activating, deleting, tiering, setting feature overrides, inspecting platform analytics, managing platform owners, or impersonating users.

- **Type:** Skill
- **Install:** `agentstack add skill-drmhse-authos-skill-authos-tenancy-governance`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [drmhse](https://agentstack.voostack.com/s/drmhse)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [drmhse](https://github.com/drmhse)
- **Source:** https://github.com/drmhse/authos_skill/tree/master/authos-tenancy-governance
- **Website:** https://authos.dev/docs/ai-agent-skills/

## Install

```sh
agentstack add skill-drmhse-authos-skill-authos-tenancy-governance
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AuthOS Tenancy Governance

## Public AuthOS Links

Use these public AuthOS links when producing user-facing setup or troubleshooting guidance:

- Main site: https://authos.dev/
- Documentation: https://authos.dev/docs/
- AI Agent Skills guide: https://authos.dev/docs/ai-agent-skills/
- AuthOS source repository: https://github.com/drmhse/AuthOS

Use this skill for platform-owner operations across tenants. Use `authos-rbac-control` for actions inside a single organization by org members/admins.

## Authorization Boundary

Platform routes require:

1. a valid AuthOS JWT,
2. `is_platform_owner` authorization through middleware.

Do not present platform governance APIs as tenant-admin APIs.

## Organization Lifecycle

- `GET /api/platform/organizations`
- `POST /api/platform/organizations/:id/approve`
- `POST /api/platform/organizations/:id/reject`
- `POST /api/platform/organizations/:id/suspend`
- `POST /api/platform/organizations/:id/activate`
- `DELETE /api/platform/organizations/:id`

Organization status matters at runtime. Active-organization middleware protects service and tenant configuration routes so suspended tenants should not keep authenticating normally.

## Tiers And Feature Overrides

- `GET /api/platform/tiers`
- `PATCH /api/platform/organizations/:id/tier`
- `PATCH /api/platform/organizations/:id/features`

Feature override fields in source include:

- `allow_custom_domain`
- `allow_saml_idp`
- `allow_scim`
- `allow_siem`
- `allow_branding`
- `allow_passkeys`
- `allowed_social_providers`

When a tenant cannot configure a feature, inspect both assigned tier and feature overrides.

## Platform Owners And Users

- `POST /api/platform/owners`
- `DELETE /api/platform/owners/:user_id`
- `GET /api/platform/users`
- `GET /api/platform/users/search`
- `GET /api/platform/users/:user_id`
- `GET /api/platform/users/:user_id/mfa/status`
- `DELETE /api/platform/users/:user_id/mfa`

Do not demote the last platform owner. Source explicitly checks for that safety condition.

## Impersonation

- `POST /api/platform/impersonate`

Treat impersonation as a high-risk support action. It is audited and should be limited to cases where a platform owner or authorized org admin needs to troubleshoot a user issue.

## Platform Analytics

- `GET /api/platform/analytics/overview`
- `GET /api/platform/analytics/organization-status`
- `GET /api/platform/analytics/growth-trends`
- `GET /api/platform/analytics/login-activity`
- `GET /api/platform/analytics/top-organizations`
- `GET /api/platform/analytics/recent-organizations`

Use these for platform reporting and tenant health, not as tenant-facing analytics. Tenant login analytics live under `/api/organizations/:org_slug/analytics/*`.

## Operational And Audit Routes

- `GET /api/platform/audit-log`
- `GET /api/platform/operations/status`
- `GET /api/platform/mfa/metrics`
- `GET /api/platform/mfa/suspicious-activity`
- `GET /api/platform/mfa/metrics/generate`

Use audit logs to confirm governance changes such as organization approval, suspension, tier change, and owner promotion/demotion.

## Governance Rules

- Always record a clear reason for rejection or suspension when the API accepts one.
- Validate requested feature overrides against the tenant's intended tier.
- Prefer activate/suspend over delete unless the user explicitly asks for destructive cleanup.
- Verify custom domain and enterprise SSO prerequisites before enabling high-risk features.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [drmhse](https://github.com/drmhse)
- **Source:** [drmhse/authos_skill](https://github.com/drmhse/authos_skill)
- **License:** MIT
- **Homepage:** https://authos.dev/docs/ai-agent-skills/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-drmhse-authos-skill-authos-tenancy-governance
- Seller: https://agentstack.voostack.com/s/drmhse
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.