Skip to main content

Multi-Tenancy

Summary​

HR Suit carries tenant identity through authentication and application context, maintains platform tenant metadata, and scopes tenant-aware data at multiple application and persistence layers.

Audience​

  • Platform and customer administrators
  • Implementation partners
  • Developers and QA engineers
  • Solution architects and security engineers

Overview​

A tenant identifies a customer boundary within the SaaS platform. Platform metadata describes tenants and their platform-level configuration. Authenticated claims and resolved request context make tenant identity available to downstream applications, which apply tenant-scoped rules when accessing owned data.

The shared-schema, service-schema, and optional tenant-database models can coexist. The diagram does not imply that every service uses the same physical or logical isolation mechanism.

Enforcement model​

Tenant enforcement occurs at multiple layers:

  • Identity and request context establish the tenant associated with a caller or operation.
  • Gateway handling preserves tenant context for downstream requests and aggregation.
  • Application services validate tenant scope and administrative authority.
  • Persistence layers apply tenant-aware queries, filters, or explicit predicates according to the owning boundary.
  • Integration events carry tenant context so consumers can scope local processing.
  • Super-admin operations use a distinct platform-level authorization context for approved cross-tenant administration.

Because implementation varies between the monolith and extracted services, this documentation does not claim a single universal isolation control. Detailed control verification belongs in restricted security and service-specific reviews.

See Also​

Keywords​

  • SaaS tenancy
  • Tenant-scoped query
  • Super-admin context

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: architecture-team
  • Status: Draft