diff --git a/internal/resource/demo/demo.go b/internal/resource/demo/demo.go
index e055e165c0..88fe7134c0 100644
--- a/internal/resource/demo/demo.go
+++ b/internal/resource/demo/demo.go
@@ -133,6 +133,7 @@ func RegisterTypes(r resource.Registry) {
 			List:  makeListACL(TypeV1Artist),
 		},
 		Validate: validateV1ArtistFn,
+		Scope:    resource.ScopeNamespace,
 	})
 
 	r.Register(resource.Registration{
@@ -143,6 +144,7 @@ func RegisterTypes(r resource.Registry) {
 			Write: writeACL,
 			List:  makeListACL(TypeV1Album),
 		},
+		Scope: resource.ScopeNamespace,
 	})
 
 	r.Register(resource.Registration{
@@ -155,6 +157,7 @@ func RegisterTypes(r resource.Registry) {
 		},
 		Validate: validateV2ArtistFn,
 		Mutate:   mutateV2ArtistFn,
+		Scope:    resource.ScopeNamespace,
 	})
 
 	r.Register(resource.Registration{
@@ -165,6 +168,7 @@ func RegisterTypes(r resource.Registry) {
 			Write: writeACL,
 			List:  makeListACL(TypeV2Album),
 		},
+		Scope: resource.ScopeNamespace,
 	})
 }
 
diff --git a/internal/resource/registry.go b/internal/resource/registry.go
index 9d278a31cf..bd044565a7 100644
--- a/internal/resource/registry.go
+++ b/internal/resource/registry.go
@@ -20,6 +20,34 @@ var (
 	kindRegexp         = regexp.MustCompile(`^[A-Z][A-Za-z\d]+$`)
 )
 
+// Scope describes the tenancy scope of a resource.
+type Scope int
+
+const (
+	// There is no default scope, it must be set explicitly.
+	ScopeUndefined Scope = iota
+	// ScopeCluster describes a resource that is scoped to a cluster.
+	ScopeCluster
+	// ScopePartition describes a resource that is scoped to a partition.
+	ScopePartition
+	// ScopeNamespace applies to a resource that is scoped to a partition and namespace.
+	ScopeNamespace
+)
+
+func (s Scope) String() string {
+	switch s {
+	case ScopeUndefined:
+		return "undefined"
+	case ScopeCluster:
+		return "cluster"
+	case ScopePartition:
+		return "partition"
+	case ScopeNamespace:
+		return "namespace"
+	}
+	panic(fmt.Sprintf("string mapping missing for scope %v", int(s)))
+}
+
 type Registry interface {
 	// Register the given resource type and its hooks.
 	Register(reg Registration)
@@ -45,6 +73,9 @@ type Registration struct {
 	// Mutate is called to fill out any autogenerated fields (e.g. UUIDs) or
 	// apply defaults before validation.
 	Mutate func(*pbresource.Resource) error
+
+	// Scope describes the tenancy scope of a resource.
+	Scope Scope
 }
 
 type ACLHooks struct {