Problem: Multi-tenant use of installation credentials hasn't been explicitly verified — today's behavior is proven for a single installer, not for many simultaneous tenants.
Area: Platform / Security
Proposal: Confirm and, where needed, harden that installation credentials are time-limited and scoped strictly to their own repo, verified explicitly under concurrent multi-tenant load rather than assumed from single-tenant behavior.
Deliverables:
- Verified, documented behavior (with tests) that one tenant's credentials cannot be used against another tenant's repo under any code path.
Acceptance criteria:
Boundaries:
Part of #4778.
Reconciliation decision (#5669, resolved 2026-07-15): NOT a duplicate of #4941/#5225 -- #5225 explicitly disclaims the overlap in its own text ("a different concern from Rent-a-Loop's #4794... do not merge the two issues"). This issue verifies what a rented job is allowed to touch at runtime; #4941/#5225 are about AMS's own identity layer and how AMS custodies/rotates its own operational secrets across tenants. Keep all three open independently; this issue stays blocked on #4783 only.
Problem: Multi-tenant use of installation credentials hasn't been explicitly verified — today's behavior is proven for a single installer, not for many simultaneous tenants.
Area: Platform / Security
Proposal: Confirm and, where needed, harden that installation credentials are time-limited and scoped strictly to their own repo, verified explicitly under concurrent multi-tenant load rather than assumed from single-tenant behavior.
Deliverables:
Acceptance criteria:
Boundaries:
Part of #4778.
Reconciliation decision (#5669, resolved 2026-07-15): NOT a duplicate of #4941/#5225 -- #5225 explicitly disclaims the overlap in its own text ("a different concern from Rent-a-Loop's #4794... do not merge the two issues"). This issue verifies what a rented job is allowed to touch at runtime; #4941/#5225 are about AMS's own identity layer and how AMS custodies/rotates its own operational secrets across tenants. Keep all three open independently; this issue stays blocked on #4783 only.