# X_JOB_TENANT_REQUIRED

## Means

the job declares no tenant

## Typical cause

the field was omitted — normally a compile error, checked again at declaration, and reached through `backfill()` too, which forwards its `tenant` to `job()` verbatim. A job body runs with no request behind it, and `@ultimat3/entity`'s tenant guard derives from the **ambient** context, so a job that declared nothing ran with no tenant at all: a row naming another org was refused over HTTP as `X_TENANCY_ACTOR_MISMATCH` and accepted through the queue. A boot-supplied service actor would close the same hole with one identity for every job, which is the cross-tenant read the declaration exists to prevent. `'none'` declares **no** org either way, but it reads differently on each side of the factory: on a `job()` it means the body touches no tenant-scoped table, because every scoped read then fails closed as `X_TENANCY_ACTOR_ORG_REQUIRED`; on a `backfill()` it is how a sweep says it spans every tenant, and the pass — never the author — opens the cross-tenant scope for it

## Fix

add `tenant: (input) => input.orgId` to the job; use `tenant: 'none'` for a job that touches no tenant-scoped table, or for a `backfill()` that sweeps every tenant

[Jobs](/error-codes#jobs)