tenant configuration, plus runtime constraint checking