Options include shared collections with tenant IDs, separate schemas, database-per-tenant, and hybrid isolation.

How to apply it

Scope reads, updates, deletes, aggregations, exports, search, and background jobs by verified tenant context. Add constraints and explicit cross-tenant denial tests. Choose isolation based on compliance, scale, customization, and cost.

Worked example

Query a project using both its ID and the authenticated organization ID rather than ID alone.

Common mistakes to avoid

A missed tenant filter in an export or worker can expose customer data.

Practice task

Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.