How a Three-Tier Policy Cascade Governs Multi-Tenant AI Agent Platforms

Multi-tenant AI agent platforms face complex configuration challenges when managing permissions across companies, repositories, and individual workspaces. A policy cascade model addresses this by organizing settings across three tiers — company, repo, and workspace — where each level can override or restrict the one below it. Certain fields, such as compliance rules and security settings, are locked at the company tier and cannot be overridden by lower levels. Secrets follow a reverse resolution order, with workspace-level credentials taking priority over company-level fallbacks. This governance architecture, which also controls API surface access and skill visibility, is the model powering the ToolShell agent platform.