Agent Orchestration Layer

multi-tenant agent orchestration

Agent Orchestration Layer — Multi-Tenancy over OpenClaw

Turned a single-user CLI agent runtime into a multi-tenant service without forking it.

closed source
role
AI engineer
status
dormant
scale
ran in 2 products
stack
Python · FastAPI · TypeScript · PostgreSQL
type
internal platform · closed source

FIG.01 // OPENCLAW · TENANCY BOUNDARY

Multi-tenant above the line, untouched below it

The runtime was consumed as a dependency, not modified. The tool extension loads into it rather than forking it.

Multi-tenant above the line, untouched below it01 · PRODUCTSGarageworkspaceNetworkChainssales02 · ID + ROLESupstream proxyJWT · roles · secret03 · FASTAPI ORCHESTRATIONOWNERSHIP SCOPINGper user / orgowner checked per agentPER-AGENT TOOLStool resolver5s cache · invalidation route04 · RUNTIME LINK1 multiplexed linkWS RPC · Ed25519 deviceOPENCLAW RUNTIME — NOT MINELOADED, NOT FORKED265-tool extension57 integrationsOPENCLAWagent runtimesingle-user CLISECOND DOORMCP server40 tools · stdio/SSE[] rather than 403 / 404:existence never leaksran in productionacross both products;now dormant
01

Multi-tenancy as an extension, not a fork

OpenClaw is an open-source CLI agent runtime, authored by its own maintainers and designed to run for one person on one laptop. It has no concept of organisations, no per-user agent ownership and no HTTP service boundary.

I built the layer above it: two FastAPI orchestration backends that expose the runtime over HTTP, and a custom TypeScript tool extension with 265 tools across 57 integrations, loaded into the runtime rather than forked into it. The runtime was consumed as a dependency, not modified into one.

The per-user agent-assignment layer ran in production across both products. It is now dormant; the surrounding products have since moved on.

265 tools57 integrations2 products

02

Roles at the proxy, ownership on every call

Agents are assigned to users and organisations. Role rules (founders see every agent in the org, employees only the agents assigned to them) run in the upstream proxy, which also strips client-supplied identity headers so they cannot be spoofed; the FastAPI layer checks the owner of every agent it touches.

Identity comes from an upstream backend behind a constant-time shared-secret check. There is no local user table.

03

A per-agent tool surface over one runtime link

Tools are resolved per agent behind a 5-second cache, and a cache-invalidation route makes a newly assigned integration appear on the agent's next attempt rather than after the TTL. On a public page, a Q&A guard hides all but 5 read-only context tools.

An MCP server exposes 40 tools over stdio or SSE, a second front door onto the same surface.

One persistent, multiplexed WebSocket RPC connection carries every agent session, so the runtime is driven as a remote peer rather than by per-session process control. Its device id is the sha256 of the raw 32-byte Ed25519 public key.

5s tool cache5 public read-only tools40 MCP tools