Resolves a request into a tenancy Context, and is the authorization authority.
Two credential classes:
Service (admin) — the presented bearer equals the configured service key. A service caller may assert
x-foresight-role/x-foresight-prefixheaders (still constrained by anyauth.tenant_scopesallowlist). This is the ops / test impersonation path.Tenant — any other presented bearer. Its role is resolved from the tenant-key registry keyed on
(tenant_id, api_key), and its schema prefix is resolved from theTenantLifecycleledger keyed ontenant_id. Client-suppliedx-foresight-role/x-foresight-prefixheaders are ignored for tenant callers — this is what prevents a client from asserting another tenant's role.
Anything that resolves to neither a valid service credential nor a registered tenant
key is rejected (401). There is no silent downgrade to a broader scope.