Add small SaaS profile proof

infospace/profiles/small-saas/artifacts/control.namespace-per-tenant.yaml

@@ -0,0 +1,14 @@
+id: small-saas/control/namespace-per-tenant
+kind: control
+title: Namespace Per Tenant Control
+profile: small-saas
+policy_id: small-saas/policy/tenant-isolation
+claim: Every production tenant has a distinct runtime namespace and data partition.
+control_type: preventive
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: satisfies
+    target: small-saas/policy/tenant-isolation
+  - type: evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/artifacts/dataset.subscription-ledger.yaml

@@ -0,0 +1,21 @@
+id: small-saas/dataset/subscription-ledger
+kind: dataset
+title: Subscription Ledger Dataset
+profile: small-saas
+owner_service: small-saas/service/billing-portal
+classification: customer-confidential
+tenant_scope: per-tenant
+tenant_ids:
+  - small-saas/tenant/acme
+  - small-saas/tenant/globex
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: owned_by
+    target: small-saas/service/billing-portal
+  - type: partitioned_for
+    target: small-saas/tenant/acme
+  - type: partitioned_for
+    target: small-saas/tenant/globex
+  - type: governed_by
+    target: small-saas/policy/tenant-isolation

infospace/profiles/small-saas/artifacts/deployment.production.yaml

@@ -0,0 +1,22 @@
+id: small-saas/deployment/production
+kind: deployment
+title: Production Deployment
+profile: small-saas
+service_id: small-saas/service/billing-portal
+environment: production
+namespace_strategy: namespace-per-tenant
+tenant_namespaces:
+  small-saas/tenant/acme: tenant-acme
+  small-saas/tenant/globex: tenant-globex
+network_exposure: public-ingress-authenticated
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: deploys
+    target: small-saas/service/billing-portal
+  - type: separates
+    target: small-saas/tenant/acme
+  - type: separates
+    target: small-saas/tenant/globex
+  - type: implements
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/evidence.access-review-2026-05.yaml

@@ -0,0 +1,18 @@
+id: small-saas/evidence/access-review-2026-05
+kind: evidence
+title: Access Review 2026-05
+profile: small-saas
+evidence_type: review-record
+date: "2026-05-23"
+supports:
+  - small-saas/service/billing-portal
+  - small-saas/policy/tenant-isolation
+  - small-saas/control/namespace-per-tenant
+  - small-saas/incident/cross-tenant-access-attempt
+relationships:
+  - type: supports
+    target: small-saas/policy/tenant-isolation
+  - type: supports
+    target: small-saas/control/namespace-per-tenant
+  - type: supports
+    target: small-saas/incident/cross-tenant-access-attempt

infospace/profiles/small-saas/artifacts/incident.cross-tenant-access-attempt.yaml

@@ -0,0 +1,15 @@
+id: small-saas/incident/cross-tenant-access-attempt
+kind: incident
+title: Cross-Tenant Access Attempt
+profile: small-saas
+status: resolved
+tenant_id: small-saas/tenant/acme
+control_ids:
+  - small-saas/control/namespace-per-tenant
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: constrained_by
+    target: small-saas/control/namespace-per-tenant
+  - type: evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/artifacts/policy.tenant-isolation.yaml

@@ -0,0 +1,15 @@
+id: small-saas/policy/tenant-isolation
+kind: policy
+title: Tenant Isolation Policy
+profile: small-saas
+scope: service-and-data-plane
+statement: Tenant requests, namespaces, access grants, and data partitions must not cross tenant boundaries.
+control_ids:
+  - small-saas/control/namespace-per-tenant
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: requires
+    target: small-saas/control/namespace-per-tenant
+  - type: evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/artifacts/service.billing-portal.yaml

@@ -0,0 +1,28 @@
+id: small-saas/service/billing-portal
+kind: service
+title: Billing Portal Service
+profile: small-saas
+system_id: small-saas/system/billing-system
+owner_team: small-saas/team/platform
+runtime_deployment: small-saas/deployment/production
+datasets:
+  - small-saas/dataset/subscription-ledger
+controls:
+  - small-saas/control/namespace-per-tenant
+policies:
+  - small-saas/policy/tenant-isolation
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: part_of
+    target: small-saas/system/billing-system
+  - type: owned_by
+    target: small-saas/team/platform
+  - type: stores
+    target: small-saas/dataset/subscription-ledger
+  - type: deployed_as
+    target: small-saas/deployment/production
+  - type: governed_by
+    target: small-saas/policy/tenant-isolation
+  - type: protected_by
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/system.billing-system.yaml

@@ -0,0 +1,17 @@
+id: small-saas/system/billing-system
+kind: system
+title: Small SaaS Billing System
+profile: small-saas
+service_ids:
+  - small-saas/service/billing-portal
+tenant_ids:
+  - small-saas/tenant/acme
+  - small-saas/tenant/globex
+owner_team: small-saas/team/platform
+relationships:
+  - type: includes
+    target: small-saas/service/billing-portal
+  - type: serves
+    target: small-saas/tenant/acme
+  - type: serves
+    target: small-saas/tenant/globex

infospace/profiles/small-saas/artifacts/task.onboard-tenant.yaml

@@ -0,0 +1,16 @@
+id: small-saas/task/onboard-tenant
+kind: task
+title: Onboard Tenant
+profile: small-saas
+owner_team: small-saas/team/platform
+status: ready
+target_tenant: small-saas/tenant/acme
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: owned_by
+    target: small-saas/team/platform
+  - type: changes
+    target: small-saas/tenant/acme
+  - type: governed_by
+    target: small-saas/policy/tenant-isolation

infospace/profiles/small-saas/artifacts/team.platform.yaml

@@ -0,0 +1,14 @@
+id: small-saas/team/platform
+kind: team
+title: Platform Team
+profile: small-saas
+owner_user: small-saas/user/ada-admin
+responsibilities:
+  - service ownership
+  - tenant onboarding
+  - access review
+relationships:
+  - type: owns
+    target: small-saas/service/billing-portal
+  - type: performs
+    target: small-saas/task/onboard-tenant

infospace/profiles/small-saas/artifacts/tenant.acme.yaml

@@ -0,0 +1,12 @@
+id: small-saas/tenant/acme
+kind: tenant
+title: Acme Tenant
+profile: small-saas
+namespace: tenant-acme
+data_partition: subscription-ledger:tenant=acme
+primary_user: small-saas/user/ada-admin
+relationships:
+  - type: represented_by
+    target: small-saas/user/ada-admin
+  - type: isolated_by
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/tenant.globex.yaml

@@ -0,0 +1,9 @@
+id: small-saas/tenant/globex
+kind: tenant
+title: Globex Tenant
+profile: small-saas
+namespace: tenant-globex
+data_partition: subscription-ledger:tenant=globex
+relationships:
+  - type: isolated_by
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/user.ada-admin.yaml

@@ -0,0 +1,19 @@
+id: small-saas/user/ada-admin
+kind: user
+title: Ada Admin
+profile: small-saas
+person_type: human
+teams:
+  - small-saas/team/platform
+access_grants:
+  - role: tenant-admin
+    tenant_id: small-saas/tenant/acme
+    policy_id: small-saas/policy/tenant-isolation
+    evidence_id: small-saas/evidence/access-review-2026-05
+relationships:
+  - type: member_of
+    target: small-saas/team/platform
+  - type: has_access_under
+    target: small-saas/policy/tenant-isolation
+  - type: access_evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/profile.yaml

@@ -0,0 +1,112 @@
+id: small-saas
+kind: profile
+profile: small-saas
+title: Small SaaS System Profile
+scope: A compact tenant-aware SaaS service with users, teams, data, access, deployment, governance evidence, and incident handling.
+status: proof
+conformance_level: profile-proof
+assumptions:
+  - The SaaS product has a single service boundary and two example tenants.
+  - Tenants are separated by namespace and data partitioning claims.
+  - User management is represented through users, teams, access grants, policies, controls, and evidence.
+  - Runtime concerns are represented by one production deployment.
+required_standards:
+  - kernel/itc-core
+  - model/landscape
+  - model/organization
+  - model/governance
+  - model/task
+  - model/access-control
+  - model/security
+  - model/data
+  - model/devsecops
+  - model/network
+  - model/observability
+  - standard/tagging
+  - standard/caring
+required_concepts:
+  service:
+    status: required
+    model: model/landscape
+  system:
+    status: required
+    model: model/landscape
+  tenant:
+    status: required
+    model: model/organization
+  user:
+    status: required
+    model: model/organization
+  team:
+    status: required
+    model: model/organization
+  dataset:
+    status: required
+    model: model/data
+  deployment:
+    status: required
+    model: model/devsecops
+  task:
+    status: required
+    model: model/task
+  policy:
+    status: required
+    model: model/governance
+  control:
+    status: required
+    model: model/security
+  evidence:
+    status: required
+    model: model/observability
+  incident:
+    status: required
+    model: model/security
+optional_concepts:
+  billing-plan:
+    status: optional
+    model: model/data
+  notification:
+    status: optional
+    model: model/observability
+out_of_scope:
+  - multi-region disaster recovery
+  - tenant-managed encryption keys
+  - marketplace billing integrations
+artifact_ids:
+  - profile/small-saas
+  - small-saas/service/billing-portal
+  - small-saas/system/billing-system
+  - small-saas/tenant/acme
+  - small-saas/tenant/globex
+  - small-saas/user/ada-admin
+  - small-saas/team/platform
+  - small-saas/dataset/subscription-ledger
+  - small-saas/deployment/production
+  - small-saas/task/onboard-tenant
+  - small-saas/policy/tenant-isolation
+  - small-saas/control/namespace-per-tenant
+  - small-saas/evidence/access-review-2026-05
+  - small-saas/incident/cross-tenant-access-attempt
+validation_rules:
+  required_artifact_kinds:
+    - service
+    - system
+    - tenant
+    - user
+    - team
+    - dataset
+    - deployment
+    - task
+    - policy
+    - control
+    - evidence
+    - incident
+  service_ownership: required
+  tenant_namespace_separation: required
+  user_management_trace: required
+  access_control_trace: required
+  governance_evidence: required
+demo_commands:
+  - PYTHONPATH=src python3 -m info_tech_canon profile inspect small-saas
+  - PYTHONPATH=src python3 -m info_tech_canon profile validate small-saas
+  - PYTHONPATH=src python3 -m info_tech_canon profile graph small-saas