Tenant Customization and Governance

Customization model

Use three layers:

1. Global source packs — maintained by Capablio or licensed partners.
2. Tenant overlays — enable, disable, weight, route, or schedule source content without changing its identity.
3. Tenant-owned content — custom constructs, question families, variants, bundles, and packs.

A tenant should fork a source item only when it needs to change meaning or wording materially. Simple configuration should remain an overlay.

Tenant-specific questions

A tenant question requires:

• tenant-owned stable ID
• construct mapping or explicit unmapped status
• source and owner
• audience and respondent relationships
• observation window
• answer scale
• cooldown and exposure cap
• reporting and anonymity rules
• approval status
• review date
• version history

AI-assisted authoring may suggest wording, but an authorized human must approve publication.

Tenant-specific bundles

A tenant may define:

• values bundle
• role-specific capability bundle
• transformation-program bundle
• customer-account bundle
• security or compliance bundle
• onboarding, promotion, or role-transition bundle

Bundles may be time-bounded and event-triggered.

Organization hierarchy and routing

Support:

• legal entities
• business units
• departments
• teams
• projects
• locations and regions
• manager hierarchy
• matrix manager
• communities of practice
• customer-account teams
• role, job family, level, and tenure attributes

Routing should be attribute-based and testable in a preview before launch.

Governance roles

Publishing workflow

1. Draft
2. Automated lint
3. Peer or expert review
4. Privacy and applicability review
5. Coverage and quota simulation
6. Pilot
7. Approval
8. Publish immutable version
9. Monitor item quality
10. Revise, supersede, or retire

Content inheritance

Tenant overlay rules should have explicit precedence:

1. Legal or global safety block
2. Tenant security and privacy policy
3. Tenant overlay disable or routing restriction
4. Pack defaults
5. Family defaults

An overlay must not be able to re-enable a globally prohibited item.

Versioning

• Global pack versions use semantic versioning.
• Tenant overlays pin to a base version.
• A base update produces a diff and compatibility report.
• Tenants choose automatic patch updates, approval-required minor updates, and manual major updates.
• Historical survey instances retain the exact published artifact.

Localization

• Variants are translated, not dynamically machine-translated at delivery time.
• Translation status is visible.
• A translated variant must retain the same construct and family but may have a separate validation status.
• Right-to-left layout and locale-specific scale labels must be supported.

Admin safeguards

• Preview every respondent journey.
• Estimate survey volume and fatigue before activation.
• Warn when a small group will be consistently suppressed by anonymity rules.
• Warn when a custom question asks about a behavior the respondent cannot observe.
• Warn when an item is double-barreled, overly long, or uses sensitive data.
• Require a purpose and retention category for custom free-text prompts.

Multi-tenant enterprise structure

For large customers, support a parent tenant with delegated sub-tenants or business units:

• shared global framework
• local overlays
• central policy floor
• local scheduling
• controlled cross-unit benchmarks
• data residency partitioning where required
• consolidated but privacy-safe reporting