Suspending a tenant does not suspend it

A tenant can carry the status suspended, and nothing anywhere reads that status on the sign-in path. A suspended tenant's accounts keep signing in.

Found on 2026-09-23 while documenting User Journey: Retire or reset a tenant.

Evidence:

• The status values are seeded in projects/ores.sql/create/iam/iam_tenant_statuses_create.sql: bootstrapping, active, suspended and terminated. The type is modelled at projects/ores.iam/modeling/ores.iam.tenant_status.org.
• Searching projects/ores.iam/ and projects/ores.sql/create/iam/ for suspended returns only three files: the status type, the model, and the table that seeds the rows. No handler, no query and no guard reads the value.
• Nothing in projects/ores.iam/core/include/ores.iam.core/messaging/auth_handler.hpp or account_operations_handler.hpp mentions suspended, tenant_status or 'terminated'.
• There is no suspend operation to set it either: the permission iam::tenants:suspend is seeded and unused, and no lifecycle function implements suspension.

So suspension is a label with no effect today. Two things are missing, and both are needed before the status means anything:

1. A way to set it. The candidate is iam.v1.tenants.suspend, which should refuse the system tenant exactly as the other lifecycle functions do — see Delete can terminate the system tenant.
2. A check that enforces it where it matters. The sign-in path must refuse an account whose tenant is not active, and say why, so the person is not left guessing whether their password was wrong.

A related consequence worth fixing in the same wave: locking an account does not end its open sessions, and neither would suspending a tenant. Ending them is a separate change.

• projects/ores.sql/create/iam/iam_tenant_statuses_create.sql — the seeded statuses.
• projects/ores.iam/modeling/ores.iam.tenant_status.org — the model.
• projects/ores.iam/core/include/ores.iam.core/messaging/auth_handler.hpp — where the check belongs.

• User Journey: Retire or reset a tenant
• Delete can terminate the system tenant