ADR-023: Console admin tenant switch strategy

Status

Accepted.

Context

Console global administrators need to inspect and operate tenant-scoped pages without logging out and back in for each tenant. Their access token already carries stellaops:admin=true and a home-tenant stellaops:tenant claim, so the remaining question is how the selected tenant is represented on each request.

Decision

The Console switches tenant context by sending the canonical X-StellaOps-TenantId header on each request. Authority does not re-issue an access token for every tenant switch. Downstream resource-server tenant resolution honors that header only when the principal carries stellaops:admin=true; non-admin principals remain claim-first and cannot use a header to override their token tenant.

Rejected Alternative

Per-switch token re-issue was rejected. It adds Authority round trips and session churn without materially improving authorization, because the same global-admin claim is the gate for cross-tenant access. It also makes ordinary navigation fragile when multiple tabs switch tenants independently.

Consequences