carlos / platform Public

What we want

Tenant email scoped to an instance, not just an app. A multi-tenant app like titogo runs one instance per customer under a single app (titogo in account tito, instances created through the console's instances API). Each customer needs their own sender:

• Their own domain, claimed and verified for that instance: DKIM, MAIL FROM, and records printed for the customer to publish.
• A credential scoped to that instance's domains only, delivered only to that instance's config and never to the app-wide bundle.
• Their own daily cap and pause. One customer's bounce or complaint rate pauses that customer, not the app. Caps are set per instance by the operator, or by tier through GrantBlock.Source.
• Their own counts in carlos email status, and ideally their own SES tenant for reputation isolation.

Why the current primitive doesn't fit (as of origin/main c1d40eeb)

• The record, DailyCap and pause are per (account, app). Every customer shares one budget, and one customer's abuse pause stops mail for all of them.
• EnsureUser writes ONE policy listing every domain granted to the app. That credential goes out as CARLOS_SMTP_* to every instance, so code running in one customer's instance can send as every other customer's verified domain. This is the blocker. titogo's isolation model exists to stop one account's code execution reaching another account.
• TenantName(acct) and ConfigSetName(acct) are per CARLOS account, so there's one reputation and one event stream for the whole customer base.

What titogo does meanwhile

titogo has its own per-account SES senders through its OAuth relay (per-account SES tenants, with the AWS key held only by the relay). It has never been switched on and has no caps. We'd rather the platform own caps, pauses and counts than grow them in the relay, which is what this request is for.

Related

• #147: sending as an address under an identity CARLOS doesn't own (jelly@tito.io across two accounts). An instance-scoped sender would likely share the address/claim model sketched there.
• Tenant email was enabled on the Tito deployment on 2026-09-14 (teamtito/carlos-infrastructure#16). The first domain is mail.go.tito.io for the titogo app.