Reference for how authentication, users, tenants, and per-tenant configuration work in sv0-platform. For the operational end-to-end flow, see [Authentication, end-to-end](../runbooks/authentication-end-to-end.md).
Adopt a B2B multi-tenant authentication architecture with an external identity provider as source of truth, URL-scoped tenants, SecurityV0 as its own organization, and cross-tenant super-admins via internal-org membership.
Phased implementation plan for adopting WorkOS as the identity provider, rebuilding tenant/user/membership model, URL-scoping tenants to /t/:slug, and establishing the SecurityV0 super-admin pattern. Implements ADR-016 and ADR-017.