Multi-Tenant Isolation
Choose the tenancy tier by sensitivity, derive the tenant from the verified token once, enforce it in layers below the code that could forget it, keep noisy neighbours from starving each other, and test for leaks before a customer does.
Last updated
After this section you can
- Choose a tenancy tier for each group of tenants, and name the provider limits it inherits
- Derive the tenant from the verified token once, and bind the store so a dropped filter cannot leak
- Prove isolation with canary tenants and a role-by-role check, with a second approver for break-glass
15
Multi-Tenant Isolation
Choose the tier by sensitivity, derive the tenant from the verified token once, and prove the boundary with canary tenants.
Key idea
Tenancy is decided once, from the verified token, and enforced below the code that could forget it. How much you share is a dial set by sensitivity, not by budget.
Three tiers, one tenant ID: every layer filters on it
Illustrative: the group sizes are assumptions, not data. Pans sideways on a phone.