How should multi-tenant provisioning work for OEM connected products?

Separate factory credentials, OEM tenant IDs, and end-user accounts so one partner cannot provision another partner's devices. Use one-time setup tokens bound to serial ranges and rotate cloud enrollment keys per contract. For a white-label gateway, test two OEM sandboxes against the same backend to prove tenant isolation before shipping.