A multi-tenant system stores many organizations' data in shared tables, distinguished by a tenant identifier. The alternative — a database per customer — trades operational complexity for isolation.

The hard part is not the schema, it is enforcement. Every read and every write has to be scoped, and the scoping has to survive a tired engineer writing a query at the end of a long day.

The durable answer is to enforce it below the application: database-level policies keyed off membership, so the identifier can never be supplied by the client and trusted.

Why it matters

Cross-tenant leakage is the failure mode a B2B tool does not recover from. It is worth designing against structurally, not procedurally.