diff --git a/internal/gateway/methods/tenants.go b/internal/gateway/methods/tenants.go
index fd57465b..e8e6b80c 100644
--- a/internal/gateway/methods/tenants.go
+++ b/internal/gateway/methods/tenants.go
@@ -34,14 +34,14 @@ func NewTenantsMethods(tenantStore store.TenantStore, msgBus *bus.MessageBus, wo
 
 // Register registers tenant management RPC methods.
 func (m *TenantsMethods) Register(router *gateway.MethodRouter) {
-	router.Register("tenants.list", m.handleList)
-	router.Register("tenants.get", m.handleGet)
-	router.Register("tenants.create", m.handleCreate)
-	router.Register("tenants.update", m.handleUpdate)
-	router.Register("tenants.users.list", m.handleUsersList)
-	router.Register("tenants.users.add", m.handleUsersAdd)
-	router.Register("tenants.users.remove", m.handleUsersRemove)
-	router.Register("tenants.mine", m.handleMine)
+	router.Register(protocol.MethodTenantsList, m.handleList)
+	router.Register(protocol.MethodTenantsGet, m.handleGet)
+	router.Register(protocol.MethodTenantsCreate, m.handleCreate)
+	router.Register(protocol.MethodTenantsUpdate, m.handleUpdate)
+	router.Register(protocol.MethodTenantsUsersList, m.handleUsersList)
+	router.Register(protocol.MethodTenantsUsersAdd, m.handleUsersAdd)
+	router.Register(protocol.MethodTenantsUsersRemove, m.handleUsersRemove)
+	router.Register(protocol.MethodTenantsMine, m.handleMine)
 }
 
 func (m *TenantsMethods) handleList(ctx context.Context, client *gateway.Client, req *protocol.RequestFrame) {
diff --git a/internal/permissions/policy.go b/internal/permissions/policy.go
index 90dce0f2..fef208e2 100644
--- a/internal/permissions/policy.go
+++ b/internal/permissions/policy.go
@@ -279,10 +279,10 @@ func isAdminMethod(method string) bool {
 		protocol.MethodTeamsTaskDeleteBulk,
 
 		// Tenants — write paths.
-		"tenants.create",
-		"tenants.update",
-		"tenants.users.add",
-		"tenants.users.remove",
+		protocol.MethodTenantsCreate,
+		protocol.MethodTenantsUpdate,
+		protocol.MethodTenantsUsersAdd,
+		protocol.MethodTenantsUsersRemove,
 
 		// API keys expose secret material — gate list + mutations as admin.
 		protocol.MethodAPIKeysList,
@@ -434,10 +434,10 @@ func isReadMethod(method string) bool {
 		protocol.MethodVoicesList,
 
 		// Tenants read
-		"tenants.list",
-		"tenants.get",
-		"tenants.users.list",
-		"tenants.mine",
+		protocol.MethodTenantsList,
+		protocol.MethodTenantsGet,
+		protocol.MethodTenantsUsersList,
+		protocol.MethodTenantsMine,
 
 		// Teams read
 		protocol.MethodTeamsList,
diff --git a/pkg/protocol/methods.go b/pkg/protocol/methods.go
index 63ad5b0f..81c05c80 100644
--- a/pkg/protocol/methods.go
+++ b/pkg/protocol/methods.go
@@ -165,6 +165,18 @@ const (
 	MethodTeamsEventsList = "teams.events.list"
 )
 
+// Tenants (multi-tenant management)
+const (
+	MethodTenantsList        = "tenants.list"
+	MethodTenantsGet         = "tenants.get"
+	MethodTenantsCreate      = "tenants.create"
+	MethodTenantsUpdate      = "tenants.update"
+	MethodTenantsUsersList   = "tenants.users.list"
+	MethodTenantsUsersAdd    = "tenants.users.add"
+	MethodTenantsUsersRemove = "tenants.users.remove"
+	MethodTenantsMine        = "tenants.mine"
+)
+
 // API key management
 const (
 	MethodAPIKeysList   = "api_keys.list"