Add small SaaS profile proof

infospace/profiles/small-saas/artifacts/control.namespace-per-tenant.yaml

@@ -0,0 +1,14 @@
+id: small-saas/control/namespace-per-tenant
+kind: control
+title: Namespace Per Tenant Control
+profile: small-saas
+policy_id: small-saas/policy/tenant-isolation
+claim: Every production tenant has a distinct runtime namespace and data partition.
+control_type: preventive
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: satisfies
+    target: small-saas/policy/tenant-isolation
+  - type: evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/artifacts/dataset.subscription-ledger.yaml

@@ -0,0 +1,21 @@
+id: small-saas/dataset/subscription-ledger
+kind: dataset
+title: Subscription Ledger Dataset
+profile: small-saas
+owner_service: small-saas/service/billing-portal
+classification: customer-confidential
+tenant_scope: per-tenant
+tenant_ids:
+  - small-saas/tenant/acme
+  - small-saas/tenant/globex
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: owned_by
+    target: small-saas/service/billing-portal
+  - type: partitioned_for
+    target: small-saas/tenant/acme
+  - type: partitioned_for
+    target: small-saas/tenant/globex
+  - type: governed_by
+    target: small-saas/policy/tenant-isolation

infospace/profiles/small-saas/artifacts/deployment.production.yaml

@@ -0,0 +1,22 @@
+id: small-saas/deployment/production
+kind: deployment
+title: Production Deployment
+profile: small-saas
+service_id: small-saas/service/billing-portal
+environment: production
+namespace_strategy: namespace-per-tenant
+tenant_namespaces:
+  small-saas/tenant/acme: tenant-acme
+  small-saas/tenant/globex: tenant-globex
+network_exposure: public-ingress-authenticated
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: deploys
+    target: small-saas/service/billing-portal
+  - type: separates
+    target: small-saas/tenant/acme
+  - type: separates
+    target: small-saas/tenant/globex
+  - type: implements
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/evidence.access-review-2026-05.yaml

@@ -0,0 +1,18 @@
+id: small-saas/evidence/access-review-2026-05
+kind: evidence
+title: Access Review 2026-05
+profile: small-saas
+evidence_type: review-record
+date: "2026-05-23"
+supports:
+  - small-saas/service/billing-portal
+  - small-saas/policy/tenant-isolation
+  - small-saas/control/namespace-per-tenant
+  - small-saas/incident/cross-tenant-access-attempt
+relationships:
+  - type: supports
+    target: small-saas/policy/tenant-isolation
+  - type: supports
+    target: small-saas/control/namespace-per-tenant
+  - type: supports
+    target: small-saas/incident/cross-tenant-access-attempt

infospace/profiles/small-saas/artifacts/incident.cross-tenant-access-attempt.yaml

@@ -0,0 +1,15 @@
+id: small-saas/incident/cross-tenant-access-attempt
+kind: incident
+title: Cross-Tenant Access Attempt
+profile: small-saas
+status: resolved
+tenant_id: small-saas/tenant/acme
+control_ids:
+  - small-saas/control/namespace-per-tenant
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: constrained_by
+    target: small-saas/control/namespace-per-tenant
+  - type: evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/artifacts/policy.tenant-isolation.yaml

@@ -0,0 +1,15 @@
+id: small-saas/policy/tenant-isolation
+kind: policy
+title: Tenant Isolation Policy
+profile: small-saas
+scope: service-and-data-plane
+statement: Tenant requests, namespaces, access grants, and data partitions must not cross tenant boundaries.
+control_ids:
+  - small-saas/control/namespace-per-tenant
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: requires
+    target: small-saas/control/namespace-per-tenant
+  - type: evidenced_by
+    target: small-saas/evidence/access-review-2026-05

infospace/profiles/small-saas/artifacts/service.billing-portal.yaml

@@ -0,0 +1,28 @@
+id: small-saas/service/billing-portal
+kind: service
+title: Billing Portal Service
+profile: small-saas
+system_id: small-saas/system/billing-system
+owner_team: small-saas/team/platform
+runtime_deployment: small-saas/deployment/production
+datasets:
+  - small-saas/dataset/subscription-ledger
+controls:
+  - small-saas/control/namespace-per-tenant
+policies:
+  - small-saas/policy/tenant-isolation
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: part_of
+    target: small-saas/system/billing-system
+  - type: owned_by
+    target: small-saas/team/platform
+  - type: stores
+    target: small-saas/dataset/subscription-ledger
+  - type: deployed_as
+    target: small-saas/deployment/production
+  - type: governed_by
+    target: small-saas/policy/tenant-isolation
+  - type: protected_by
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/system.billing-system.yaml

@@ -0,0 +1,17 @@
+id: small-saas/system/billing-system
+kind: system
+title: Small SaaS Billing System
+profile: small-saas
+service_ids:
+  - small-saas/service/billing-portal
+tenant_ids:
+  - small-saas/tenant/acme
+  - small-saas/tenant/globex
+owner_team: small-saas/team/platform
+relationships:
+  - type: includes
+    target: small-saas/service/billing-portal
+  - type: serves
+    target: small-saas/tenant/acme
+  - type: serves
+    target: small-saas/tenant/globex

infospace/profiles/small-saas/artifacts/task.onboard-tenant.yaml

@@ -0,0 +1,16 @@
+id: small-saas/task/onboard-tenant
+kind: task
+title: Onboard Tenant
+profile: small-saas
+owner_team: small-saas/team/platform
+status: ready
+target_tenant: small-saas/tenant/acme
+evidence_ids:
+  - small-saas/evidence/access-review-2026-05
+relationships:
+  - type: owned_by
+    target: small-saas/team/platform
+  - type: changes
+    target: small-saas/tenant/acme
+  - type: governed_by
+    target: small-saas/policy/tenant-isolation

infospace/profiles/small-saas/artifacts/team.platform.yaml

@@ -0,0 +1,14 @@
+id: small-saas/team/platform
+kind: team
+title: Platform Team
+profile: small-saas
+owner_user: small-saas/user/ada-admin
+responsibilities:
+  - service ownership
+  - tenant onboarding
+  - access review
+relationships:
+  - type: owns
+    target: small-saas/service/billing-portal
+  - type: performs
+    target: small-saas/task/onboard-tenant

infospace/profiles/small-saas/artifacts/tenant.acme.yaml

@@ -0,0 +1,12 @@
+id: small-saas/tenant/acme
+kind: tenant
+title: Acme Tenant
+profile: small-saas
+namespace: tenant-acme
+data_partition: subscription-ledger:tenant=acme
+primary_user: small-saas/user/ada-admin
+relationships:
+  - type: represented_by
+    target: small-saas/user/ada-admin
+  - type: isolated_by
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/tenant.globex.yaml

@@ -0,0 +1,9 @@
+id: small-saas/tenant/globex
+kind: tenant
+title: Globex Tenant
+profile: small-saas
+namespace: tenant-globex
+data_partition: subscription-ledger:tenant=globex
+relationships:
+  - type: isolated_by
+    target: small-saas/control/namespace-per-tenant

infospace/profiles/small-saas/artifacts/user.ada-admin.yaml

@@ -0,0 +1,19 @@
+id: small-saas/user/ada-admin
+kind: user
+title: Ada Admin
+profile: small-saas
+person_type: human
+teams:
+  - small-saas/team/platform
+access_grants:
+  - role: tenant-admin
+    tenant_id: small-saas/tenant/acme
+    policy_id: small-saas/policy/tenant-isolation
+    evidence_id: small-saas/evidence/access-review-2026-05
+relationships:
+  - type: member_of
+    target: small-saas/team/platform
+  - type: has_access_under
+    target: small-saas/policy/tenant-isolation
+  - type: access_evidenced_by
+    target: small-saas/evidence/access-review-2026-05