Project 4 — Multi-Tenant AI SaaS

Project 4 — the multi-tenant AI SaaS — is the full SaaS: the tenants, the billing, the isolation, and the compliance (L384) — the scope (the product L384: the tenants L320, the plans L332, the regions L261, L384), the architecture (the L357 shape L357: the front door L267, the isolation L320, the metering L332, L384), and the build (the billing L332: the per-token L332 and the per-seat L357; the compliance L371: the GDPR L371 and the SOC 2 L371; and the isolation L320: the per-tenant L320 data, L384) — the SaaS's (L357) proof (L384).

The one-sentence interview answer: "Project 4 is the full SaaS, built (L384). The scope (L384): the product (L384) — the tenants (L320): the multi-tenant (L357) workspace (L384); the plans (L332): the tiered (L332) pricing (L332); and the regions (L261): the residency (L261) by the tenant (L320). The architecture (L384): the L357 shape (L357) — the front door (L267): the gateway (L267) with the auth (L319) and the quotas (L149); the isolation (L320): the tenant ID (L320) in the data (L313), the vectors (L183), and the caches (L269); and the metering (L332): the tokens (L332) per tenant (L320). The build (L384): the billing (L332) — the per-token (L332) and the per-seat (L357) — the L334 attribution (L334); the compliance (L371) — the GDPR (L371): the residency (L261) and the deletion (L312); the SOC 2 (L371): the audit (L322); and the isolation (L320) — the wall (L320) at the data layer (L384). The AI shape (L173): the SaaS (L384) — the tenants (L320), the billing (L332), the isolation (L320), and the compliance (L371) — the L357 shape (L357), built (L384), the SaaS's (L357) proof (L384)."

Think of the multi-tenant SaaS as the office tower, operated. The tower (the SaaS, L384): the floors (the tenants, L320) — each with the locked (L320) doors; the leases (the plans, L332) — the per-floor (L357) rent (L332); the meters (the metering, L332) — the utilities (the tokens, L332) per floor (L320); the inspections (the compliance, L371) — the fire code (the SOC 2, L371) and the privacy code (the GDPR, L371); and the management (the platform, L378) — the front desk (the gateway, L267) and the records (the audit, L322). The tower works because the floors are locked, the meters are per-floor, and the codes are met (L384).

   the office tower (the SaaS, L384)
   ┌────────────────────────────────────────────────────────┐
   │ the floors (the tenants, L320) — the locked (L320)     │
   │ the leases (the plans, L332) · the meters (the         │
   │ metering, L332) · the inspections (the compliance,     │
   │ L371) · the front desk (the gateway, L267)             │
   └────────────────────────────────────────────────────────┘

The mental model is the office tower: the floors, the meters, and the inspections (L384).

   THE SCOPE (L384) → the product (L384)
        │
        ▼
   THE ARCHITECTURE (L384) → the L357 shape (L357)
        │
        ▼
   THE BILLING (L332) → the per-token (L332) + the per-seat (L357)
        │
        ▼
   THE COMPLIANCE (L371) → the GDPR (L371) + the SOC 2 (L371)
        │
        ▼
   THE ISOLATION (L320) → the wall at the data layer (L384)

The flow is the build: scope → architecture → billing → compliance → isolation (L384).

• The scope (L384). The product (L384): the tenants (L320), the plans (L332), the regions (L261).
• The architecture (L384). The L357 shape (L357): the front door (L267), the isolation (L320), the metering (L332).
• The billing (L332). The per-token (L332) and the per-seat (L357) — the L334 attribution (L334).
• The compliance (L371). The GDPR (L371) and the SOC 2 (L371).
• The build (L384). The isolation (L320): the wall (L320) at the data layer (L384).

• The portfolio (L103). Project 4 (L384) — the L357 proof (L384).
• An interview (L384). The walkthrough (L384) — the tenants to the compliance (L384).
• An AI SaaS (L357). The multi-tenant (L357) — the billing (L332) and the isolation (L320).
• A regulated SaaS (L371). The GDPR (L371) — the residency (L261) and the audit (L322).
• Anything SaaS (L357). The capstone (L384) — the L357 shape (L357), built (L384).

The through-line: the proof is the SaaS's — the tenants, the billing, the isolation, and the compliance (L384).

Say it in four moves:

1. The scope. "The tenants (L320), the plans (L332), the regions (L261)."
2. The architecture. "The L357 shape (L357) — the door (L267), the wall (L320), the meter (L332)."
3. The billing. "The per-token (L332) and the per-seat (L357)."
4. The compliance. "The GDPR (L371) and the SOC 2 (L371)."

• The wall is the data layer's (L320). The tenant ID (L320) in the vectors (L183) and the filters (L189) — the L357 wall (L357), at the data (L384).
• The meter is the billing's (L332). The tokens (L332) per tenant (L320) — the L334 attribution (L334) — the per-tenant (L357) margin (L384).
• The quota is the abuse's (L149). The per-tenant (L320) cap (L149) — the L318 limits (L318) — the L317 abuse (L317), bounded (L384).
• The residency is the region's (L261). The tenant's (L320) region (L261) — the GDPR (L371) — the L366 cloud (L366), in the capstone (L384).
• The audit is the SOC 2's (L322). The who, the what, the when (L322) — the L371 evidence (L371) — the L322 record (L322), built (L384).

• The single-tenant (L384). The app (L384) without the tenants (L320) — the wall (L320) missing (L384).
• The shared data (L320). The one index (L183) and the one cache (L269) — the cross-tenant (L320) — the isolation (L320) (L384).
• The un-metered (L332). The usage (L332) un-attributed (L334) — the billing (L332) and the margin (L357) impossible (L384).
• The residency ignored (L261). The data (L313) in the wrong region (L261) — the GDPR (L371) (L384).
• The un-audited (L322). The SOC 2 (L371) — the record (L322) missing (L384).

• Wall the data layer (L320) — the tenant ID (L320) everywhere (L384).
• Meter the tenants (L332) — the tokens (L332) per tenant (L320).
• Quota the tenants (L149) — the per-tenant (L320) caps (L384).
• Residency the data (L261) — the tenant's (L320) region (L261).
• Audit everything (L322) — the SOC 2 (L371) evidence (L384).

Q: Walk me through Project 4.

A: The full SaaS, built (L384). The scope — the tenants (L320), the plans (L332), the regions (L261). The architecture — the L357 shape (L357): the door (L267), the wall (L320), the meter (L332). The billing — the per-token (L332) and the per-seat (L357). And the compliance — the GDPR (L371) and the SOC 2 (L371).

Q: How do you isolate the tenants?

A: The L357 wall (L357) at the data layer (L384): the tenant ID (L320) in the vector indexes (L183) and the retrieval's filters (L189); the tenant ID (L320) in the cache's keys (L269); and the tenant ID (L320) in the prompts' context (L312). The isolation (L320) is the data's (L384), not just the app's (L384).

Q: How does the billing work?

A: The metering (L332): the tokens (L332) per tenant (L320) — the L334 attribution (L334); and the seats (L357) — the users (L162) per tenant (L320). The plans (L332) — the per-token (L332) and the per-seat (L357) — the margin (L334) per tenant (L384).

Q: How do you handle the compliance?

A: The GDPR (L371): the residency (L261) — the tenant's (L320) region (L261); and the deletion (L312) — the "right to be forgotten" (L371). The SOC 2 (L371): the audit (L322) — the who, the what, the when (L322). The L371 frameworks (L371), built in (L384).

• What's the scope (L384)?
• How do you isolate the tenants (L320)?
• How does the billing work (L332)?
• How do you handle the compliance (L371)?
• What's the arc (L384)?

The senior read: the right column is the capstone — the full SaaS (L384).

// Project 4 (L384) — the multi-tenant SaaS (L384).
// 1 · THE TENANT CONTEXT (L320) — from the auth (L319).
function tenantContext(req) {
  return { tenantId: req.tenantId, region: regionOf(req.tenantId) };  // L320, L261
}

// 2 · THE ISOLATION (L320) — the data-layer wall (L384).
async function retrieve(ctx, query) {
  return index.search(`tenant:${ctx.tenantId}`, query, {   // L183, L320
    filter: { tenantId: { equals: ctx.tenantId } },        // L189, L384
  });
}
const cacheKey = `tenant:${ctx.tenantId}:resp:${hash(query)}`;  // L269, L320

// 3 · THE METERING (L332) — the billing (L384).
async function meter(ctx, usage) {
  const cost = costOf(usage, ctx.model);                   // L334
  await metering.write({ tenantId: ctx.tenantId, tokens: usage, cost });  // L332
  // the per-token (L332) and the per-seat (L357) billing (L384)
}

// 4 · THE QUOTA (L149) — the per-tenant cap (L384).
if (await metering.tenantMonth(ctx.tenantId) > quotaOf(ctx.tenantId)) {
  return error(429);                                       // L149, L318
}

// 5 · THE COMPLIANCE (L371) — the residency (L261) and the audit (L322).
await invokeIn(ctx.region, prompt);                        // L261, L371
await audit.log({ who, what, when, tenantId: ctx.tenantId });  // L322

What the reader must SEE — the build, started:

  tenantId + region from the auth → the context (L319, L261)
  the per-tenant index + cache    → the wall (L183, L269, L320)
  metering per tenant             → the billing (L332, L334)
  the per-tenant quota → 429      → the cap (L149, L318)
  the region's invoke + the audit → the compliance (L261, L322)

  The tenants, the billing, the isolation, the compliance (L384).

• The wall is the retrieval's (L320). The per-tenant (L320) index (L183) — the filter (L189) narrows (L384).
• The meter is the batch's (L332). The per-tenant (L320) usage (L332) — the L334 attribution (L334), batched (L384).
• The quota is the cost's (L149). The per-tenant (L320) cap (L149) — the bill (L334) bounded (L384).
• The residency is the latency's (L261). The tenant's (L320) region (L261) — the L333 latency (L333) by the region (L384).

• Project 4 = the SaaS's proof (L384): the scope, the architecture, the billing, the compliance.
• The scope: the tenants (L320), the plans (L332), the regions (L261).
• The architecture: the L357 shape (L357) — the door (L267), the wall (L320), the meter (L332).
• The billing: the per-token (L332) and the per-seat (L357).
• The compliance: the GDPR (L371) and the SOC 2 (L371).

PROJECT 4: MULTI-TENANT AI SAAS = the full SaaS

THE SCOPE (L384)
  the tenants (L320) — the multi-tenant (L357) workspace (L384)
  the plans (L332) — the tiered (L332) pricing (L332)
  the regions (L261) — the residency (L261) by the tenant (L320)

THE ARCHITECTURE (L384) — THE L357 SHAPE (L357)
  the front door (L267) — the gateway (L267), the auth (L319),
  the quotas (L149)
  the isolation (L320) — the tenant ID (L320) in the data (L313),
  the vectors (L183), the caches (L269)
  the metering (L332) — the tokens (L332) per tenant (L320)

THE BILLING (L332)
  the per-token (L332) · the per-seat (L357)
  the L334 attribution (L334) · the margin (L357)

THE COMPLIANCE (L371)
  the GDPR (L371) — the residency (L261), the deletion (L312)
  the SOC 2 (L371) — the audit (L322)

INTERVIEW, 4 MOVES
  1 scope   "the tenants, the plans, the regions (L384)"
  2 architecture "the L357 shape (L357)"
  3 billing "the per-token and the per-seat (L332)"
  4 compliance "the GDPR and the SOC 2 (L371)"

You now hold the fourth proof: the tenants, the billing, the isolation, and the compliance — with the floors locked and the meters per-floor. The office tower is operated — and the codes are met (L384).

Next: the SSO, the RBAC, the audit, and the grounding inside the enterprise firewall — Project 5 (L385).