System designHard~20 min

Interview question

Design a backend for a SaaS product where multiple customer tenants share the same application. How would you enforce isolation?

Design a multi-tenant SaaS backend boundary

Designs tenant isolation across API, data, cache, background jobs, search, and admin access.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I would derive tenant context from authenticated membership or trusted server-side routing, not from a raw tenant id supplied by the client. Every tenant-owned table would carry tenant scope, and API queries would filter by tenant and resource ownership. Authorization would check both the user's role and the specific resource. Cache keys, background jobs, exports, and search documents would also include tenant scope.

Full answer below

Practice focus

Tenant identity, authorization, data modeling, query filtering, cache keys, background jobs, search indexes, admin tools, and auditability.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Tenant isolation is a system-wide boundary spanning identity, queries, caches, search, files, messages, jobs, exports, observability, and administrative access. A missing tenant scope in any one path can become a cross-customer incident.
I would derive tenant context from authenticated membership or trusted server-side routing, not from a raw tenant id supplied by the client. Every tenant-owned table would carry tenant scope, and API queries would filter by tenant and resource ownership. Authorization would check both the user's role and the specific resource. Cache keys, background jobs, exports, and search documents would also include tenant scope.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would decide early between shared database, separate schema, or separate database per tenant based on isolation, cost, operations, and customer requirements. For a shared model, I would use indexes that start with tenant id for common access patterns and tests that prove cross-tenant access fails. Admin tools need explicit tenant selection and extra auditing because they can bypass normal user paths. I would also prevent tenant scope from disappearing in async messages or scheduled jobs.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I make tenant isolation testable and observable across API policies, queries, cache keys, object storage, search documents, messages, exports, and background jobs. Audit records capture cross-tenant administrative access and denied attempts without turning ordinary reads into excessive noise. Capacity controls prevent one tenant from exhausting shared pools, and encryption or regional placement follows the product's compliance boundary. If selected customers require stronger isolation, routing can place them on dedicated databases or infrastructure behind the same application contract. The decision is driven by risk, operations, noisy-neighbor behavior, and customer obligations rather than by treating one tenancy model as universally mature.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Trusting tenant ids sent by the browser.
Filtering tenant data only in controllers and not in jobs or exports.
Using cache keys that omit tenant scope.
Forgetting admin tools and search indexes.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Treats multi-tenancy as a single EF filter.
Cannot explain resource ownership checks.
Has no strategy for enterprise isolation requirements.
Ignores cross-tenant incidents as security events.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When would you use separate databases per tenant?
How would background jobs carry tenant context?
How would you test tenant isolation?

Continue practice

No explicit flow link is set yet, so these are nearby drills from the same path or taxonomy.

Abstraction vs encapsulationConcept question / Easy / ~5 minContinue Access modifiersConcept question / Easy / ~5 minContinue ActionResult vs Typed ResultsComparison question / Medium / ~7 minContinue

System designHard~20 min

Interview question

Design a backend for a SaaS product where multiple customer tenants share the same application. How would you enforce isolation?

Design a multi-tenant SaaS backend boundary

Designs tenant isolation across API, data, cache, background jobs, search, and admin access.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Tenant identity, authorization, data modeling, query filtering, cache keys, background jobs, search indexes, admin tools, and auditability.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Tenant isolation is a system-wide boundary spanning identity, queries, caches, search, files, messages, jobs, exports, observability, and administrative access. A missing tenant scope in any one path can become a cross-customer incident.
I would derive tenant context from authenticated membership or trusted server-side routing, not from a raw tenant id supplied by the client. Every tenant-owned table would carry tenant scope, and API queries would filter by tenant and resource ownership. Authorization would check both the user's role and the specific resource. Cache keys, background jobs, exports, and search documents would also include tenant scope.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would decide early between shared database, separate schema, or separate database per tenant based on isolation, cost, operations, and customer requirements. For a shared model, I would use indexes that start with tenant id for common access patterns and tests that prove cross-tenant access fails. Admin tools need explicit tenant selection and extra auditing because they can bypass normal user paths. I would also prevent tenant scope from disappearing in async messages or scheduled jobs.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I make tenant isolation testable and observable across API policies, queries, cache keys, object storage, search documents, messages, exports, and background jobs. Audit records capture cross-tenant administrative access and denied attempts without turning ordinary reads into excessive noise. Capacity controls prevent one tenant from exhausting shared pools, and encryption or regional placement follows the product's compliance boundary. If selected customers require stronger isolation, routing can place them on dedicated databases or infrastructure behind the same application contract. The decision is driven by risk, operations, noisy-neighbor behavior, and customer obligations rather than by treating one tenancy model as universally mature.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Trusting tenant ids sent by the browser.
Filtering tenant data only in controllers and not in jobs or exports.
Using cache keys that omit tenant scope.
Forgetting admin tools and search indexes.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Treats multi-tenancy as a single EF filter.
Cannot explain resource ownership checks.
Has no strategy for enterprise isolation requirements.
Ignores cross-tenant incidents as security events.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When would you use separate databases per tenant?
How would background jobs carry tenant context?
How would you test tenant isolation?

Continue practice

No explicit flow link is set yet, so these are nearby drills from the same path or taxonomy.

Design a backend for a SaaS product where multiple customer tenants share the same application. How would you enforce isolation?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Design a backend for a SaaS product where multiple customer tenants share the same application. How would you enforce isolation?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice