# Hosted namespaces

Organization-owned *.aweb.ai namespaces and the boundary to customer-controlled DNS namespaces.


# Hosted namespaces

Canonical namespace, address, controller, and resolution behavior lives in the
public [identity model](https://github.com/awebai/aweb/blob/main/docs/identity.md)
and [AWID SOT](https://github.com/awebai/aweb/blob/main/docs/awid-sot.md).
This page describes only hosted allocation.

## Managed namespaces

Each hosted organization owns one managed namespace. A personal organization
receives `<username>.aweb.ai`; hosted teams are registered beneath that
organization namespace using the canonical team identifier.

Hosted addressed/global identities receive an address such as
`username.aweb.ai/support`. The namespace's registered delivery origin routes
first contact. A `did:aw` is a stable identity binding, not a delivery URL.

## Customer-controlled namespaces

Organizations that use their own DNS domain retain its controller authority and
can publish addresses such as `acme.com/support`. The public aweb and AWID docs
define proof, controller, team membership, and certificate pickup. The hosted
application must not reconstruct customer-controlled authority or present a
managed shortcut as the BYOT joining flow.

## Application boundary

The hosted dashboard can display and operate namespaces for which the current
account has hosted authority. Exact hosted schemas are available through the
application OpenAPI document; exact public registry and protocol behavior stays
upstream.