multi-tenant-architecture-expert

license	Apache-2.0
name	multi-tenant-architecture-expert
description	Tenant isolation, row-level security, shared/siloed schema patterns for SaaS platforms. Activate on: multi-tenant, tenant isolation, RLS, shared database, SaaS architecture, tenant context, data isolation. NOT for: connection pooling (use database-connection-pool-manager), API gateway routing (use api-gateway-reverse-proxy-expert).
allowed-tools	Read,Write,Edit,Bash(npm:*,npx:*,psql:*)
category	Backend & Infrastructure
tags	["multi-tenant","saas","rls","tenant-isolation","postgres"]
pairs-with	[{"skill":"database-connection-pool-manager","reason":"Pool segmentation per tenant or shared pool tuning"},{"skill":"api-rate-limiting-throttling-expert","reason":"Per-tenant rate limits prevent noisy neighbors"},{"skill":"cache-strategy-invalidation-expert","reason":"Cache keys must be tenant-scoped"}]

Multi-Tenant Architecture Expert

Design and implement multi-tenant SaaS systems with proper data isolation, tenant context propagation, and noisy neighbor prevention.

Activation Triggers

Activate on: "multi-tenant", "tenant isolation", "RLS", "shared database", "SaaS architecture", "tenant context", "data isolation", "noisy neighbor", "tenant onboarding"

NOT for: Connection pool sizing → database-connection-pool-manager | API gateway tenant routing → api-gateway-reverse-proxy-expert | Authorization framework → relevant auth skill

Quick Start

1. Choose isolation model — shared DB with RLS (cost-efficient), schema-per-tenant (moderate), DB-per-tenant (maximum isolation)
2. Propagate tenant context — extract from JWT/header, set in middleware, available throughout request lifecycle
3. Enforce at database level — Row-Level Security policies in PostgreSQL, not just application-level WHERE clauses
4. Scope everything — caches, queues, file storage, logs must all include tenant ID
5. Prevent noisy neighbors — per-tenant rate limits, connection limits, and resource quotas

Core Capabilities

Domain	Technologies
Database RLS	PostgreSQL RLS, Supabase RLS, Neon branch-per-tenant
Schema Isolation	PostgreSQL schemas, schema_search_path
Tenant Context	AsyncLocalStorage (Node), cls-hooked, middleware injection
ORMs	Prisma multi-schema, Drizzle with RLS, TypeORM tenant scope
Infrastructure	Kubernetes namespaces, AWS Organizations, tenant-aware CDN

Architecture Patterns

Shared Database with PostgreSQL RLS

-- Enable RLS on all tenant tables
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;

-- Policy: tenants see only their own data
CREATE POLICY tenant_isolation ON orders
  USING (tenant_id  current_setting()::uuid);


  app.current_tenant  ;


   orders;