5 / 7 Multi-Tenancy, Isolation & Quotas

Two Kinds Of Tenant

A SaaS has 3 enterprise tenants that drive 62% of load and carry contractual isolation requirements, plus 2,000 small tenants that self-serve and drive the rest.

cost per tenant blast radius noisy neighbor onboarding
silo high, idle capacity per stack one tenant none provisions infrastructure
pool low, scales with real load all tenants present, needs quotas a row in a table
bridge mixed by tier mixed by tier contained for siloed tiers two paths to maintain

Which arrangement fits, and why?

A

Pool everything, but give the three enterprises dedicated read replicas. That is the standard bridge model and it satisfies the isolation clause at a fraction of the cost.

B

Bridge: silo the three enterprises so the compliance and noisy-neighbor terms are met at three-stack cost, and pool the 2,000 small tenants so onboarding stays a database write and cost tracks real load.

C

Silo everything. The enterprise contracts already require it, and running one deployment model is simpler than maintaining two provisioning and monitoring paths.

D

Pool everything. Per-tenant quotas remove the noisy neighbor and row-level security removes cross-tenant access, so silo adds cost without adding a property the pool lacks.