8. Tenants

A tenant file changes the base definitions for that tenant only:

# config/agents/tenants/acme.yaml
tenant: acme                     # must match tenants.slug
workflows:
  enabled: [invoice_v1]          # empty or absent = every enabled workflow
overrides:
  invoice_v1:
    nodes:
      approval:                  # deep-merged over the node in invoice_v1.yaml
        with:
          auto_approve: { enabled: true }
connectors:                      # deep-merged over connectors/<id>.yaml
  accounting:
    kind: webhook
    options: { url: "https://erp.acme.example/hooks" }
    credentials: { hmac_secret: '<%= get_env(name="ACME_ACCOUNTING_HMAC_SECRET") %>' }

At boot, each tenant with overrides gets its own compiled copy of the affected workflows. The copy is validated like any other workflow, so an override that names a node that doesn't exist stops boot. The shipped acme.yaml turns on auto-approval. Its connector override is commented out, because a webhook needs a real URL and signing secret.