---
# System prepended metadata

title: Multi-Tenancy

---

## Questions
1. How to build the authentication layer now (using api-token) and later be able to integrate the Keycloak?
2. How to start the Agent CE without additional manipulations with Accounts and Wallets?

Option 1:
1. Implement Account/Wallet REST API
2. Bootstrap the default Wallet and default account from the configuration at the startup.

Option 2:
Have a different service layers:
AccountService - SingleTenantAccountService(configuration)
WalletService - SingleTenantWalletService(configuration)

AccountService - MTLocalAccountService(postgresql)
WalletService - MTLocalWalletService(postgresql)
+ configuration section with the bootsrap operation (create wallet/account etc)



## Requirements
For Agent CE (Community Edition)
1. Start the agent with preconfigured Admin token (basic or jwt or ony other)
2. REST API for managing the Accounts (local IAM system)
3. REST API or configuration for Account authentication method config
    3.1 User/Password JWT (prefferred) token authentication can be configured - in CE Agent
    3.2 `api-token` authentication can be configured - in the engieering env
4. REST API for managing the Wallets
    4.1 Account config to own the Wallet

5. Define the policies and/roles for the REST API of the Agent
    5.1 Roles: 
        agent-admin - local admin protected by the token
        admin - from JWT token managed by external AIM system
        user - regular user role, the owner of the wallet
        holder/issuer/verifier?
        unauthorized - for DID resolver and fetching the VC schema by id
        
    Decision: for MVP Phase #1 of MT we need to have three roles: admin, account, anauthorized
        




## Model

There is an Account
There is a Wallet
Admin creates the Account and the Wallet
Admin assign the Wallet to the Account (1:1 relation)


