Multi-Tenant Subdomain + Isolated Workload Model

When each customer expects an isolated product experience, architecture shortcuts quickly become operational debt.

Core design choices

1. Routing model for tenant discovery and request isolation
2. Workload isolation level per tenant (shared vs dedicated)
3. Upgrade lifecycle and rollback strategy at scale

Tenant model checklist

• ✓Define tenant lifecycle events (create, update, suspend, delete).
• ✓Standardize subdomain naming and certificate handling.
• ✓Set isolation defaults for compute, data, and secrets.
• ✓Design upgrade playbooks with tenant-safe rollback.