Multi-tenant SaaS data plane
Tenant routing into two isolation tiers — pooled shared-table with row-level security for the many, database-per-tenant silos for the few — with per-tenant quotas keeping neighbors quiet.
What this design does
Every SaaS eventually runs both isolation models at once: a dense pooled tier where thousands of tenants share tables behind row-level security, and a silo tier where enterprise contracts demand their own database. The interesting component is the tenant router — a directory that decides, per tenant, which world a request lives in. Quotas at the edge keep one tenant's bulk import from becoming everyone's outage.
The patterns it composes
- Shared-table + discriminator (RLS) — pooled tenants isolated by row-level security, not hope
- Database-per-tenant — the silo tier for compliance and blast-radius contracts
- Tenant router (directory lookup) — tenant id → tier + cell, changeable per tenant
- Per-tenant quotas — noisy neighbors throttled at the edge, fairly
- Cell-based tenancy — each tier is cells, so failures stay small
Import it, attach your own numbers, and verify the design against failures — or read the engineering notes.