StoredDocument.tenantId is the organization that owns the document. It is taken from the X-Organization-Id header on the render call that stored it, and it is the isolation boundary for the whole service: GET /api/documents, the single-document download, and the bulk DELETE /api/documents all filter on tenantId, so one tenant can never list or fetch another tenant's PDFs. The model indexes tenantId (alone and paired with source and category) to keep those tenant-scoped queries fast.
Skarn PDF
StoredDocument.tenantId
The tenant that owns a StoredDocument — every read and delete is scoped to it.