Multi-Tenant SaaS Architecture

Use this skill to join product tenancy semantics to system boundaries and operating decisions. It owns the cross-cutting architecture choice, not the implementation or specialist evidence behind each choice.

Workflow

1. Frame the service promise. Identify customer/account shape, users and operators, subscription commitments, regions, data classes, lifecycle states, support model, scale assumptions, and unknowns. Separate contractual promises from aspirations.
2. Define tenant semantics. Load references/tenant-domain-model-and-boundaries.md. Establish tenant, account, organization, user, membership, subscription, entitlement, resource, and environment meanings, ownership, cardinality, and lifecycle authority.
3. Separate planes. Load references/control-and-application-planes.md. Draw the control-plane policy and lifecycle responsibilities apart from application-plane request and data serving, including asynchronous handoffs and failure behavior.
4. Choose isolation per resource. Load references/tenancy-and-data-partitioning-models.md. Compare pooled, bridge, silo, and hybrid choices by data, compute, cache, queue, search, and operational resource. Record why the choice meets the promise and what can trigger a change.
5. Connect the commercial path. Load references/onboarding-identity-entitlements-metering-billing.md. Trace signup, identity, provisioning, configuration, entitlement evaluation, usage capture, invoice authority, suspension, support, and reactivation without making billing or security policy implicit.
6. Design lifecycle and operations. Load references/tenant-aware-operations-capacity-and-cost.md. Cover deployment, observability, quotas, hot tenants, restore scope, export/deletion, cost attribution, and escalation. Route evidence-heavy decisions to the specialist owners.
7. Record and challenge. Use templates/saas-architecture-brief.md, templates/tenancy-decision-record.md, and templates/tenant-lifecycle-checklist.md. Test cross-tenant safety, lifecycle idempotency, entitlement lag, billing disagreement, restore scope, and noisy-neighbor behavior.

Output Contract

Produce a SaaS architecture brief with: service promise; domain vocabulary and authorities; control/application plane boundary; resource-by-resource tenancy choices; lifecycle state transitions; entitlement, metering, and billing handoffs; data and recovery boundaries; tenant-aware operational scenarios; explicit assumptions and evidence gaps; specialist handoffs; and decisions with owners and review triggers.

Ownership Boundaries