Model collections, scope access per app, and serve a versioned read API to each client site from one control plane.
One account manages every tenant.