TENANT

The aggregate belongs to its tenant alone, such as a product every shopper reads: its owner is never recorded, a read is not restricted by the caller's owner, and a write is not checked against it. Its writes are protected by action-level authorization (CoSec). A space still applies.