Self-serve sub-tenancy for managed deployments
Customers with multi-business-unit deployments can now provision and manage sub-tenancies from the Spalce console without a support ticket.
- Self-serve sub-tenancy creation in the customer console (Engagements → New Sub-Tenancy).
- OPA-backed policy bundles per sub-tenancy with version pinning.
- Per-tenant audit log export to customer-owned S3 (af-south-1, eu-west-1, us-east-1).
- Tenancy metadata schema bumped to v2 — backwards compatible via translation layer.
- Console navigation reorganized to surface sub-tenancies in the side rail.
- Audit log search now correctly returns results when filtering by sub-tenancy and severity at the same time.
- SAML SSO bindings no longer flash a 500 page when the IdP returns an unsigned response — we now show a structured error.
