4 / 7 Multi-Tenancy, Isolation & Quotas

Quotas That Overcommit

A shared service is provisioned at 12,000 CPU-seconds per second. Per-tenant quotas are enforced at the gateway.

Tenant Quota (CPU-s/s) p90 use p99 use
northwind 4,000 2,300 3,800
kestrel 4,000 1,900 3,600
vela 3,000 1,400 2,900
orrery 2,000 900 1,850
everyone else 1,000 600 950
total 14,000 7,100 13,100

A reviewer flags that the quotas sum to 14,000 on a 12,000 fleet. What is the correct response?

A

It is fine because the gateway enforces the quotas, so aggregate demand cannot exceed 14,000 and the fleet only needs to be sized for that number to be correct.

B

It is deliberate overcommit. A quota is a per-tenant ceiling, not a reservation, and the design bets that peaks do not coincide. It is only safe if the service sheds low-criticality work when they do, so the missing piece is graceful degradation, not smaller quotas.

C

It is a capacity bug. Quotas must sum to at most capacity or the per-tenant guarantee is void, so each should be scaled by 12/14.

D

It is fine because the p90 figures sum to 7,100, well under 12,000. Summed p90 is the admission-control condition that matters.