Architecture
The SaaS architecture decisions that are expensive to reverse
A practical guide to tenancy, permissions, metering and data boundaries before scale makes them painful.
Production software improves when teams make the operating assumptions visible, test the risky decisions early and preserve room for change.
Engineering review
Questions to answer before delivery
Is tenant context explicit in identity, data, jobs, files and events?
Can authorization answer who may perform which action on which resource?
Are plan entitlements separate from user permissions?
Can usage events support billing, limits, product analytics and cost analysis?
Is there a documented path for exceptional tenant scale or regional isolation?
Define the tenant boundary early
Decide what a tenant represents, which resources belong to it and where isolation is enforced. Ambiguity here spreads into authorization, reporting, support and every future integration. The tenant identifier should travel through authenticated requests, background jobs, file storage, caches and event messages without being inferred from user-interface state.
Make permissions part of the domain
Roles rarely remain a simple administrator-versus-user choice. Model capabilities and scopes around real responsibilities so enterprise requirements do not become scattered conditionals. Keep plan entitlements, feature configuration and security authorization distinct even when they affect the same screen.
Design metering as product data
Usage affects billing, limits, customer insight and operational cost. Capture meaningful events through a stable model rather than reconstructing them from logs after pricing becomes urgent. Each event needs an owner, tenant, timestamp, idempotency strategy and a definition that product, finance and engineering interpret consistently.
Keep escape routes open
Clear service and data boundaries allow selected tenants, workloads or regions to receive different treatment later without forcing a complete rewrite of the platform. Escape routes should be explicit architectural options, not premature physical separation for every tenant.