Multi-Tenancy Without RLS Is Theater

Multi-tenancy is not a feature.
Multi-tenancy is an isolation requirement.

Without Row-Level Security, multi-tenancy is theater.

I. The Multi-Tenancy Promise

Multi-tenancy promises:

• cost efficiency through shared infrastructure
• simplified operations
• faster scaling

These benefits are real.
They are also dangerous without proper isolation.

II. The Common Implementation

Most multi-tenant systems implement isolation through tenant IDs.

Every table has a tenant_id column.
Every query includes WHERE tenant_id = ?.

This is not isolation.
This is convention.

III. Convention Is Not Security

Convention relies on:

• developers remembering to add the filter
• code reviews catching omissions
• testing covering all paths
• no one making a mistake

Convention fails at scale.
Convention fails under pressure.
Convention fails eventually.

When convention fails, data crosses tenant boundaries.

IV. The Breach Scenario

A single missing WHERE clause.
A single debugging session with elevated access.
A single migration script without the filter.

One tenant sees another tenant’s data.

The breach may be:

• accidental
• undetected
• unreported

But it happened.
The isolation promise is broken.

V. Row-Level Security

Row-Level Security (RLS) enforces isolation at the database level.

With RLS:

• the database enforces tenant boundaries
• application code cannot bypass isolation
• missing filters cannot expose data
• elevation requires explicit action

RLS is not optional.
It is the minimum requirement for real isolation.

VI. Beyond RLS

True isolation may require:

• Schema separation: each tenant in its own schema
• Database separation: each tenant in its own database
• Physical separation: each tenant on its own infrastructure

The choice depends on:

• regulatory requirements
• data sensitivity
• breach consequences

More separation means more isolation.
More isolation means more trust.

VII. Final Conclusion

Multi-tenancy without RLS is theater.
It creates the appearance of isolation.
It does not create isolation.

When isolation fails:

• trust collapses
• liability emerges
• recovery is impossible

The cost of proper isolation is known and budgetable.
The cost of a breach is unknown and unbounded.

Choose isolation.
Not convention.