You are writing/upgrading ONE markdown page for multi-tenant-saas.com, a technical
reference site for SaaS engineers on multi-tenant data isolation, auth, routing, billing
and compliance. Tone: dense, expert, declarative, no fluff, no marketing. Match the
existing pages' voice (short authoritative sentences; concrete tools, SQL, config).
- Output is a single
content/.../index.md file. Keep the frontmatter layout and
add the full frontmatter block (below). Do not touch other files.
- No Mermaid. This site no longer renders Mermaid. Any diagram MUST be a hand-authored
inline
<svg> using the figure pattern below. If you are uplifting a page that contains
a ```mermaid block, REPLACE each one with an equivalent inline-SVG figure.
- Code blocks use a real language identifier (
typescript, sql, go, python,
ini, yaml, bash, json) — never code or blank. Every code block must be runnable
and specific, not pseudocode.
- No internal IA jargon in visible prose. Never write the words pillar, cluster,
long-tail, hub, spoke, supporting page. (A Kafka/DB "cluster" in the
infrastructure sense is fine.)
- FAQ format is plain markdown — the site JS turns it into accordions. Write each Q&A as:
## FAQ
**Question text ending in a question mark?**
Single-paragraph answer on the next line.
**Next question?**
Answer.
One blank line between pairs. Do NOT write <details> or accordion HTML yourself.
---
layout: content-page.njk
title: "<Page Title>"
description: "<145-160 char meta description, specific, no fluff>"
slug: <the-last-url-segment>
type: <pillar | cluster | long_tail>
breadcrumb: "<short breadcrumb label>"
datePublished: 2026-06-21
dateModified: 2026-06-21
---
(For pages being uplifted that already have datePublished, keep the original and set
dateModified: 2026-06-21.)
- The FIRST mention of a concept that has its own page must be an inline contextual link
woven into the sentence — not a bare "see X". Use the URL map below.
- Never link the same target twice on one page.
- Every cluster and long-tail page must up-link to its parent in the OPENING paragraph,
e.g. "It operates within the broader Multi-Tenant Database Isolation Models framework."
- End every page with a
## Related heading followed immediately by a bulleted list of
3–5 links (pillar: 4–5; cluster: 3–4; long-tail: 2–3). No intro sentence.
Pillars:
- /auth-isolation-cross-tenant-access-control/ — Auth & Cross-Tenant Access Control
- /multi-tenant-database-isolation-models/ — Multi-Tenant Database Isolation Models
- /tenant-aware-data-routing-query-scoping/ — Tenant-Aware Data Routing & Query Scoping
- /tenant-billing-usage-metering/ — Tenant Billing & Usage Metering
- /multi-tenant-compliance-data-governance/ — Multi-Tenant Compliance & Data Governance
Auth children:
- /auth-isolation-cross-tenant-access-control/role-based-access-control-per-tenant/
- /auth-isolation-cross-tenant-access-control/role-based-access-control-per-tenant/auditing-rbac-changes-across-tenants/
- /auth-isolation-cross-tenant-access-control/role-based-access-control-per-tenant/designing-tenant-scoped-permission-models/
- /auth-isolation-cross-tenant-access-control/session-isolation-state-management/
- /auth-isolation-cross-tenant-access-control/session-isolation-state-management/using-redis-for-tenant-session-isolation/
- /auth-isolation-cross-tenant-access-control/session-isolation-state-management/invalidating-tenant-sessions-on-role-change/
- /auth-isolation-cross-tenant-access-control/sso-mapping-identity-federation/
- /auth-isolation-cross-tenant-access-control/sso-mapping-identity-federation/okta-sso-integration-for-multi-tenant-apps/
- /auth-isolation-cross-tenant-access-control/sso-mapping-identity-federation/mapping-external-idp-groups-to-tenant-roles/
- /auth-isolation-cross-tenant-access-control/tenant-aware-jwt-token-management/
- /auth-isolation-cross-tenant-access-control/tenant-aware-jwt-token-management/jwt-claims-for-tenant-scoping-best-practices/
- /auth-isolation-cross-tenant-access-control/tenant-aware-jwt-token-management/rotating-tenant-specific-jwt-signing-keys/
DB children:
- /multi-tenant-database-isolation-models/shared-database-with-row-level-security/
- /multi-tenant-database-isolation-models/shared-database-with-row-level-security/implementing-rls-in-postgresql-for-saas/
- /multi-tenant-database-isolation-models/shared-database-with-row-level-security/testing-rls-policies-for-tenant-isolation/
- /multi-tenant-database-isolation-models/schema-per-tenant-architecture/
- /multi-tenant-database-isolation-models/schema-per-tenant-architecture/migrating-from-shared-db-to-schema-per-tenant/
- /multi-tenant-database-isolation-models/schema-per-tenant-architecture/schema-per-tenant-vs-row-level-security-for-hipaa/
- /multi-tenant-database-isolation-models/database-per-tenant-isolation/
- /multi-tenant-database-isolation-models/database-per-tenant-isolation/database-per-tenant-vs-schema-per-tenant-connection-pool-cost/
- /multi-tenant-database-isolation-models/cost-vs-security-tradeoff-analysis/
- /multi-tenant-database-isolation-models/cost-vs-security-tradeoff-analysis/benchmarking-shared-vs-isolated-db-costs/
Data-routing children:
- /tenant-aware-data-routing-query-scoping/tenant-context-injection-strategies/
- /tenant-aware-data-routing-query-scoping/tenant-context-injection-strategies/handling-tenant-context-in-graphql-apis/
- /tenant-aware-data-routing-query-scoping/tenant-context-injection-strategies/propagating-tenant-context-across-async-jobs/
- /tenant-aware-data-routing-query-scoping/orm-middleware-for-multi-tenancy/
- /tenant-aware-data-routing-query-scoping/orm-middleware-for-multi-tenancy/configuring-hibernate-multi-tenancy/
- /tenant-aware-data-routing-query-scoping/orm-middleware-for-multi-tenancy/prisma-client-extensions-for-tenant-scoping/
- /tenant-aware-data-routing-query-scoping/connection-pooling-in-multi-tenant-systems/
- /tenant-aware-data-routing-query-scoping/connection-pooling-in-multi-tenant-systems/preventing-sql-injection-in-multi-tenant-apps/
- /tenant-aware-data-routing-query-scoping/connection-pooling-in-multi-tenant-systems/pgbouncer-transaction-pooling-for-multi-tenant-saas/
- /tenant-aware-data-routing-query-scoping/connection-pooling-in-multi-tenant-systems/sizing-connection-pools-per-tenant-tier/
Billing children:
- /tenant-billing-usage-metering/usage-metering-event-pipelines/
- /tenant-billing-usage-metering/usage-metering-event-pipelines/idempotent-usage-event-ingestion/
- /tenant-billing-usage-metering/usage-metering-event-pipelines/tenant-partitioned-time-series-for-metering/
- /tenant-billing-usage-metering/subscription-and-plan-enforcement/
- /tenant-billing-usage-metering/subscription-and-plan-enforcement/enforcing-plan-limits-with-tenant-quotas/
- /tenant-billing-usage-metering/billing-sync-with-stripe/
- /tenant-billing-usage-metering/billing-sync-with-stripe/reconciling-stripe-webhooks-per-tenant/
Compliance children:
- /multi-tenant-compliance-data-governance/tenant-audit-logging-architecture/
- /multi-tenant-compliance-data-governance/tenant-audit-logging-architecture/generating-soc2-audit-artifacts-per-tenant/
- /multi-tenant-compliance-data-governance/gdpr-data-subject-requests/
- /multi-tenant-compliance-data-governance/gdpr-data-subject-requests/per-tenant-data-deletion-workflows/
- /multi-tenant-compliance-data-governance/per-tenant-encryption-and-key-management/
- /multi-tenant-compliance-data-governance/per-tenant-encryption-and-key-management/managing-per-tenant-encryption-keys-with-kms/
- /multi-tenant-compliance-data-governance/tenant-data-residency/
- /multi-tenant-compliance-data-governance/tenant-data-residency/routing-tenants-to-regional-data-stores/
- H1 + 2-sentence architectural framing.
- Overview comparison table (model/variant rows; columns: boundary enforcement, tenant
density, query latency, operational overhead, compliance fit).
- A top-level overview inline-SVG figure (architecture/data-flow).
- H2 Core Architecture & Pattern Variants (cross-link to child pages).
- H2 Tenant Routing & Context Propagation (+ a routing-layer table).
- H2 Compliance & Auditability Alignment (GDPR/HIPAA/SOC2/FedRAMP mapping).
- H2 Billing Sync & Metering Architecture (component table).
- H2 Migration & Hybrid Strategies.
- H2 Implementation Reference (3–5 annotated runnable code snippets across languages).
- H2 Pitfalls & Anti-Patterns (4–6 bold-named failure modes, each a paragraph).
- H2 FAQ (4–6 Q&A).
-
- Do NOT add JSON-LD HowTo to pillar pages (the template already emits Article + Breadcrumb).
- H1 + 1-sentence positioning that up-links the parent in the first paragraph.
- A checklist of prerequisites (infra, roles, framework versions) as a
- [ ] task list.
- H2 Step-by-Step Implementation — numbered steps, a runnable code block per step.
- A decision/comparison table.
- One inline-SVG figure for the hardest concept.
- H2 Dynamic Query Scoping & Connection Handling.
- H2 Security Enforcement & Access Control (+ access-layer table).
- H2 Operational Overhead & Scaling Metrics (metric/threshold/mitigation table).
- H2 Pitfalls & Anti-Patterns (3–5 bold-named).
- H2 Frequently Asked Questions (3–5 Q&A).
-
- H1 + 1-sentence problem statement; up-link the parent in the first paragraph.
- H2 Problem Framing — why this decision matters, what breaks; include ONE inline-SVG
sequence/flow figure (this REPLACES the Mermaid diagram).
- H2 Step-by-Step Guide — 3–7 numbered steps, one focused runnable code block each.
- H2 Verification — a test query / log output / assertion snippet.
- H2 Failure Modes & Gotchas — 2–4 bullets: exact symptom, root cause, one-line fix.
- H2 FAQ — 2–3 Q&A.
-
Use this exact wrapper. Hand-author the SVG specific to the page content. Rules:
viewBox set, NO fixed width/height on the <svg> element (responsive).
role="img" + aria-label on the figure's svg; include <title> and <desc>.
- Colours: backgrounds
#0f1f3d / #1a2d50, borders/strokes #c9a84c (gold),
accent text #e8c97a, body text #e2e2d8. Use these hex values directly OR
currentColor for the primary line/text colour. Do NOT rely on CSS classes for fills.
- Text:
font-family="Inter, system-ui, sans-serif", font-size 13–15 (user units),
text-anchor="middle" for centered labels. KEEP LABELS SHORT so they never overflow
their boxes — measure: a 13px label fits ~0.62 × boxWidthInUserUnits characters.
- Give boxes generous width. Prefer a viewBox around
0 0 760 H.
Template to adapt:
<figure class="diagram" role="img" aria-label="Concise description of the diagram">
<svg viewBox="0 0 760 360" xmlns="http://www.w3.org/2000/svg" font-family="Inter, system-ui, sans-serif">
<rect x="0" y="0" width="100%" height="100%" fill="#0b1220"/>
<title>Short title</title>
<desc>One-sentence description of what the diagram shows.</desc>
<defs>
<marker id="arrowGold" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L8,3 L0,6 Z" fill="#c9a84c"/>
</marker>
</defs>
<rect x="40" y="40" width="200" height="60" rx="8" fill="#1a2d50" stroke="#c9a84c" stroke-width="1.5"/>
<text x="140" y="75" text-anchor="middle" fill="#e2e2d8" font-size="14">Edge Ingress</text>
<line x1="240" y1="70" x2="360" y2="70" stroke="#c9a84c" stroke-width="1.5" marker-end="url(#arrowGold)"/>
</svg>
<figcaption>What the reader should take away from this diagram.</figcaption>
</figure>
CRITICAL: do NOT put any blank line ANYWHERE between <figure class="diagram"> and
</figure>. A blank line ends the markdown HTML block and the browser orphans the rest of
the SVG geometry (the diagram renders empty/broken). Keep the entire figure contiguous —
no empty lines inside it. Also ensure label text contrasts with its box: light text
(#e2e2d8 / #e8c97a) only on the dark fills (#0f1f3d / #1a2d50), never on light fills.
IMPORTANT: every id you reference (markers, gradients) must be DEFINED in the same SVG,
and ids must be UNIQUE within the page (suffix them per-diagram, e.g. arrowGold-2).
Aim for one strong diagram per page (pillars may have the overview plus at most one more).