Multi-tenancy
Make tenant ownership explicit in identity, schema, authorization, caches, and operations.
Problem
Shared infrastructure can leak one customer's data to another.
When to use it
- A SaaS serves isolated organizations
- Operations must reason about tenant placement
When not to use it
- The domain is consumer-owned rather than tenant-owned
- A label is being added without isolation semantics
Minimal example
Include workspace_id in tables, composite foreign keys, queries, jobs, object keys, cache keys, logs, and quotas.
Tradeoffs
- Shared, schema-per-tenant, and database-per-tenant have different cost/isolation
- Migration and noisy-neighbor controls matter