> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria.
> Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types.
> Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai.
> Do not invent a public hostname for private orchestrators or env API internals.
> Do not confuse control-plane latches with Environments confirmation latches.
> Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY.
> Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports.

# Tenancy & security

Enterprise customers get hard tenancy boundaries across Environments, the Control plane, Evaluation, and Expert Review. Isolation is enforced in the control planes, not left to agent or expert goodwill.

## Isolation bar

| Expectation                                                    | Behavior                                             |
| -------------------------------------------------------------- | ---------------------------------------------------- |
| Cross-org data (runs, trajectories, datasets, evidence)        | Denied                                               |
| Cross-workspace API access                                     | Denied: credentials bind to one org                  |
| Cross-episode state leakage in Environments                    | Denied: fresh seed on each `reset`                   |
| Cross-agent policy / permit reuse (Control plane)              | Denied: permits are single-use and agent-scoped      |
| Expert access to other orgs’ tasks or fixtures (Expert Review) | Denied                                               |
| Spoofed tenant, agent, or reviewer identity                    | Denied: identity set server-side from the credential |
| Host / orchestrator filesystem from a guest episode            | Denied: private network only                         |
| Noisy-neighbor resource exhaustion                             | Bounded queues and soft quotas                       |

## Soft quotas (illustrative)

| Quota                            | Trial (typical) | Enterprise (typical)    |
| -------------------------------- | --------------- | ----------------------- |
| Concurrent environment sessions  | 2               | 32+                     |
| Evaluations / day (Environments) | 50              | Contract                |
| Control plane `authorize` RPS    | 10              | Contract                |
| Evidence / audit retention       | 30 days         | 1 to 7 years (contract) |
| Expert seats (Expert Review)     | n/a             | Contract                |
| Dataset storage (Evaluation)     | 10 GiB          | Contract                |

Exact numbers come from your workspace contract and live usage meters. Soft quotas throttle and queue; they do not silently share capacity across orgs.

## Defaults

* **Public surface**: Eval API (`agi.akhara.ai`), Control plane PDP (`api.akhara.dev`), and documented consoles only. Orchestrators, workers, and device pools stay on the private network.
* **Auth**: Org-scoped API keys (and SSO/SAML for enterprise). Keys never authorize cross-tenant reads.
* **Episode isolation**: Each Environments run gets an isolated backend session and device assignment for that episode; teardown drops state.
* **Control plane**: Fail-closed PEP; PDP never executes customer tools; evidence feed is org-partitioned.
* **Expert Review**: Experts see only assigned packs; briefs and fixtures stay in-org; no export of other customers’ content.
* **Egress**: Environment and sandbox egress follow an allowlist on enterprise plans; trial may be open for bring-up.
* **Residency**: Enterprise can pin region (for example US or EU). Trial defaults to the primary US region.
* **Audit**: Admin and policy decisions are attributable to an org + principal; retention follows the table above.

## What we do not do

* Share device pools or catalogs across orgs in a way that exposes another tenant’s state
* Return another org’s trajectories, permits, or expert labels from any public API
* Let agents or experts choose their own tenant id in a request body

## Related

* [Environments architecture](/environments/architecture): private orchestrator and workers
* [Control plane architecture](/control-plane/concepts/architecture): PDP / PEP boundary
* [Control plane fail-closed](/control-plane/concepts/fail-closed): unreachable means blocked
* [Expert Review policies](/talent/policies/overview): expert confidentiality