Topic
Workspace-scoped data models, membership roles, and per-tenant usage accounting in shared-instance products.
The BootSaaS walkthrough puts each customer's business tables in their own PostgreSQL schema, after pricing database-per-tenant at 1,000 HikariCP pools for 1,000 tenants under Spring Boot's default data source setup.
Reality
A tester on Nile's free tier made two tenants, then ran the same SELECT on a connection that never set nile.tenant_id and got every row back. Nile's docs describe that open read as deliberate, so the guarantee sits in application code.
Reality
A solo-built WhatsApp CRM enforces its tenant boundary with row-level security on 21 tables, and the privilege that actually stopped a production insert sat on a table's auto-increment sequence, granted to one database role and not the other.
Reality
The Worker in this FastAPI pattern authorizes requests itself from a KV copy of the session, so a role change lands only when the origin's invalidation write does, and the 3600-second cap is the only other bound.
Reality
A dev.to build log for KnowBase AI publishes the load-bearing parts: retrieval scoped by workspaceId, chunks that keep a pointer home, and citations you can click. The retriever is the swappable half.
Reality