Engineering
Four multi-tenant decisions that determine your next three years
· 8 min read
Tenant isolation, identity, billing, and migration strategy are effectively irreversible. Choose them deliberately.
Multi-tenant platforms fail slowly. The architecture holds through early adoption, then becomes the constraint on every subsequent feature. Four decisions carry disproportionate weight.
1. Isolation boundary
Enforce tenant isolation at the database boundary with row-level security, not in application code. Application-level filtering fails the first time a new query path forgets the predicate — and that failure is a disclosure incident.
2. Identity and role model
Roles belong in dedicated authorisation tables, never as a column on a user profile. Privilege escalation in SaaS almost always traces back to authorisation state stored where the user can influence it.
3. Metering before billing
Instrument usage events before you need to charge for them. Retroactive metering is guesswork, and guesswork in billing erodes trust faster than a price increase.
4. Migration discipline
Every schema change ships as a reviewed, reversible migration in version control. Manual production changes are the single most common source of environment drift in platforms we inherit.