A data platform serves many internal teams with very different data volumes and sensitivity. How should tenancy be structured?

The structure

Shared infrastructure with strong logical isolation, and separate physical isolation only where sensitivity or scale demands it.

Logical isolation mechanisms:

• Separate databases or schemas per domain, with ownership and access controlled per domain.
• Row and column-level security for shared datasets containing data of mixed sensitivity.
• Per-team compute pools or workload groups, so consumption is bounded and attributable.
• Cost attribution per team, enforced at creation, since without it nothing downstream is possible.

Physical isolation where required:

• Regulated data with residency or access constraints that cannot be met by logical controls.
• A team whose scale genuinely degrades others, following the same promotion path logic as any multi-tenant system.

The access model that scales

Access granted to a role against a dataset, with the dataset's owner deciding — not a central team processing requests, which becomes the bottleneck.

Classification attached at the source and propagating through derived datasets, so a derived table containing personal data inherits the controls rather than requiring someone to remember. This is the property that makes access control tractable at scale, and retrofitting it is close to impossible.

The specific risk in a data platform

Derived datasets leaking sensitivity. A team joins a permitted dataset with another permitted dataset and produces something more sensitive than either — or aggregates data in a way that permits re-identification.

Logical isolation controls access to sources; it does not control what is produced from them. That requires classification propagation, review of new derived datasets against their inputs, and a catalogue that makes lineage visible.

The measure

Time to get access to a dataset, and the proportion of datasets with a known owner and classification. The first determines whether the platform is usable; the second determines whether it is governable — and a platform failing the second is one privacy question away from an investigation it cannot complete.