anchor.diff:      }
   }
   ----
  -<.> SecMan provides the xref:refguide:extensions:index/secman/api/tenancy/dom/HasAtPath.adoc[HasAtPath] interface to standardize the way in which domain objects expose their "tag" (atPath) to the evaluator.
  +<.> SecMan provides the xref:refguide:extensions:index/secman/applib/tenancy/dom/HasAtPath.adoc[HasAtPath] interface to standardize the way in which domain objects expose their "tag" (atPath) to the evaluator.
   <.> can view all objects (above and below) within the user's hierarchy
   +
   For example:
  
positive.code: For example, to allow a user to be able to access objects from multiple countries, we could use a format such as "/ITA;/BEL".
  The implementation would parse the string and allow access for any country.
  
  For this reason, the xref:refguide:extensions:index/secman/api/user/dom/ApplicationUser.adoc[ApplicationUser]'s `atPath` property is _not_ a foreign key to the xref:refguide:extensions:index/secman/api/tenancy/dom/ApplicationTenancy.adoc[ApplicationTenancy] entity.
  
  TIP: Another implementation of xref:refguide:extensions:index/secman/api/tenancy/spi/ApplicationTenancyEvaluator.adoc[ApplicationTenancyEvaluator] can be found in the xref:docs:demo:about.adoc[Demo App]..
  
  
  .Apache Isis' multi-tenancy is only skin deep
  
negative.code: The idea is that the ownership of domain objects is logically partitioned into tenants; one tenant cannot see or access the data owned by another tenant.
  
  Implementing multitenancy requires that both data and user is "tagged" in some way, and that these tags are compared against each other to determine if the user has access to the tagged data.
  This is represented in the domain model through the xref:refguide:extensions:index/secman/applib/tenancy/spi/ApplicationTenancyEvaluator.adoc[ApplicationTenancyEvaluator] SPI interface.
  The idea is that the application provides its own implementation of this interface, that performs the evaluation of whether the current user can view the domain object or not (and if they can, whether the domain object members are disabled/read-only).
  
  One simple implementation is to tag domain objects with a "path", and similarly to store a "path" for each application user.
  The idea behind the xref:refguide:extensions:index/secman/applib/tenancy/dom/ApplicationTenancy.adoc[ApplicationTenancy] is simply to name these tenancies; its `atPath` property is intended to be a primary key.
  The xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser] entity also has an `atPath` property.
  We could therefore use this "atPath" to represent a country, eg "/GBR", "/ITA", "/FRA", "/BEL" and so on.
  
  For example, the example below uses implements the rule that a user can always view an object within (above or below) their place in the path "hierarchy", and can edit any object "under" them in the hierarchy:
  