security · advanced
Multi-Tenant Isolation Patterns
Quick answer
Multi-tenant isolation keeps one customer from reading, writing, or starving another. Choose isolation depth—shared app + row security, schema-per-tenant, db-per-tenant, or silo cells—based on risk, cost, and compliance.
Why this matters
- Cross-tenant data leaks destroy trust.
- Noisy neighbors create fairness and SLO issues.
- Enterprise deals often require stronger isolation tiers.
Learning objectives
- Map isolation layers (identity, data, runtime, network). 2. Compare tenancy models. 3. Prevent IDOR-class bugs. 4. Control noisy neighbors. 5. Plan tenant migration between tiers.
Explain like I am 5
Apartment walls should stop neighbors from walking into your kitchen—or eating all the electricity.
Mental model
flowchart TB
TenantA --> Gateway
TenantB --> Gateway
Gateway --> AuthZ
AuthZ --> DataPlane
DataPlane --> Isolation[Row / schema / DB / cell]
Core concepts
Identity → authorization
Every query carries tenant context; never trust client-only tenant IDs.Data models
Row-level tenant_id + constraints; or physical separation for high-risk tenants.Runtime isolation
Quotas, rate limits, noisy-neighbor CPU/IO limits.Blast radius
Cells/silos limit global outages and leak scope.Compliance
Some data classes require silo or regional residency.Worked example
SaaS notes app: pooled tenancy with mandatory tenant predicate middleware + tests; enterprise tier on dedicated DB; export/migration path documented.
Trade-offs
| Max sharing | Max silo |
|---|---|
| Cheap | Expensive ops |
| Higher leak risk | Stronger isolation |
Failure modes
| Mode | Mitigation |
|---|---|
| Missing tenant filter | Central query helpers + tests |
| Shared cache keys | Namespace by tenant |
| Unlimited per-tenant fan-out | Quotas |
Interview mode
Skeleton: "Isolation is layered—authZ, data partitioning, runtime quotas, optional silos—matched to risk."
Human review
Educational guidance only. Isolation requirements for regulated or contractual tenancy must be validated with security, legal, and compliance stakeholders for your jurisdiction and customers.
Knowledge check
Queries missing tenant predicates / broken authZ
Using HTTPS
Having too many indexes
Writing ADRs
By Shubham Jain