Advanced & Roadmap

Multi-tenancy direction

CNS already threads tenant_id through every layer — tenant isolation is an access rule enforced everywhere, not a convention bolted on later (see Tenants). What Phase 1 does not yet do is run more than one Profile at a time: one cns-server process loads exactly one global profile, so two tenants that need genuinely different infrastructure (different identity providers, different store instances) need two separate processes today.

The stated direction is to key the same Profile struct per tenant_id, resolved from the authenticated token, instead of loading one profile globally — deliberately scoped as "make the profile per-tenant," not a rewrite of the adapter interfaces, the event envelope, or the trust/authz model above it. A self-serve control plane (tenant onboarding, billing, per-tenant config UI) is explicitly deferred until there's a second real client's constraints to design it against, rather than speculatively building it against one tenant's needs.

Governed event types

The Event Registry — a governed, per-tenant event catalog with versioned schemas — is the planned evolution of today's /admin/v1/event-catalog (which registers a type + an opaque, unenforced JSON Schema). It's tracked as its own design effort; see that page for current status.

Everything else

The full Phase-2 scope named in the design spec: Phase-2 roadmap.