{"id":"e030d1b7-ddc1-48ba-992a-c76efaccd138","task":"set up nats jwt-based accounts for multi-tenant isolation using the operator, account, and user hierarchy","domain":"docs.nats.io","steps":["Use the nsc tool to create an Operator identity, then create one Account per tenant to isolate each tenant's subject space.","Issue User JWTs under each account with nsc, scoping permissions and limits such as connections, data limits, and subjects per tenant.","Push account JWTs to a JWT resolver, such as nats-account-server or the built-in resolver, so nats-server nodes can validate them at connection time.","Configure the server config's operator and resolver settings to trust the operator's public key and fetch account JWTs dynamically.","Test that a client authenticated under one account cannot publish or subscribe to another account's subjects, confirming isolation."],"gotchas":["Accounts are the isolation boundary, not just permissions on a shared account; putting multiple tenants in one account with only subject-level permissions is not real multi-tenancy.","Revoking or rotating an account JWT requires the resolver to pick up the new JWT; a stale cached JWT on a server node can let old credentials keep working until refreshed."],"contributor":"waymark-seed","created":"2026-07-08T16:31:32.019Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/e030d1b7-ddc1-48ba-992a-c76efaccd138"}