arizuko › concepts › scaling

scaling

The same code runs solo/inbox and corp/eng/sre/oncall. To add users, you add rows and folders, not new infrastructure.

A new tenant is rows and a folder

Grants, routes, secrets and scheduled work keep their state as rows. To add a tenant, you write rows into those tables and create a folder under groups/. The daemon graph does not change: one routd, one authd, one adapter per platform, and one KVM guest for each running turn.

A folder tree has no fixed depth, and depth gives no rights. solo/inbox and corp/eng/sre/oncall get the same starting grants and run the same code path. Beyond the messaging floor, a folder can do only what another principal delegated to it.

Four setups run the same code

Stage	Shape	What changes
Solo	One folder, one channel, one user	Nothing: `arizuko create` makes this stage
Dogfood	A few folders, trusted users	Add folders, issue invites, enable adapters
Team	A folder tree under one world, shared admin	Folder tree, ACL rows, channel onboarding
Internet	Public callers that you do not trust	Route tokens, admission gates, egress rules

Solo

arizuko create -i myagent
arizuko group -i myagent add telegram:user/123456789 main
arizuko run myagent

One user, one channel. Getting started shows the full setup.

Dogfood

arizuko invite -i myagent create 'alice/**' --max-uses 1
arizuko group -i myagent add slack:T1234/channel/C5678 alice

Add the adapters to .env, issue invites and create folders. The env reference lists the adapter tokens.

Team

arizuko group -i myagent add slack:T1234/channel/C1111 eng
arizuko group -i myagent add slack:T1234/channel/C2222 eng/frontend
arizuko group -i myagent grant google:alice 'eng/**' admin

A nested folder gets no rights from its parent. The glob sets the reach: eng/** covers eng and every folder under it, and a bare eng covers that one folder. See grants and scopes.

Internet

arizuko token -i myagent issue chat support
arizuko gate -i myagent add '*' 50/day

A route token lets anonymous visitors in. An admission gate limits how many new users onbod admits each day. Every turn already runs behind its own filtered egress proxy, and there is no switch to turn it on. See tokens and onboarding.

Three mechanisms keep tenants apart

Tenants share one store, one set of daemons and one release image. Three mechanisms isolate them:

Folder containment: The agent of a group runs in its own KVM guest, and the home of that guest is groups/<folder>/. The guest cannot see the files of sibling folders. Scopes explains the rules.
Grant resolution: Every MCP call checks the caller, the action and the target against the ACL. A folder with only the default role can call send but not register_group. Grants explains the rows.
Egress filtering: Each turn gets its own egress proxy with the allowlist of that folder, on a tap with no other route out. The proxy always runs, and the rules apply per folder.

A full host means a second instance

When a host is full, you start a second instance with its own data directory and its own systemd unit. You do not rewrite anything. The instances share no state and route nothing to each other.