advanced 1 min answer

A platform serves internal teams with very different scale and criticality. Should they share infrastructure?

platform-tenancyisolationnoisy-neighbourtieringsalesforcearchitecture-selection
Show the full answer Hide the answer

The answer

Tiered: shared with enforced quotas for most, dedicated capacity for the few whose scale or criticality justifies it, with an explicit promotion path between them.

Why pure sharing fails

The same failure as any multi-tenant system: a resource with unbounded per-tenant consumption allocated first-come. One team's batch job consumes the shared worker pool; one team's query saturates the shared database; one team's deployment saturates the build fleet.

The consequence is worse internally than externally, because the affected teams cannot escape to a competitor — they escape to building their own, which is the outcome the platform exists to prevent.

Why pure isolation fails

Per-team infrastructure means the platform team's operational work scales with team count, which is exactly what a platform exists to avoid. It also multiplies cost and fragments the estate.

The controls that make sharing work

  • Per-team quotas on every shared resource — compute, storage, build concurrency, database connections, telemetry volume — visible to the team, because a limit they cannot see is an outage they hit by accident.
  • Fair scheduling rather than first-come for queued work, so a team with a thousand queued jobs and one with three both make progress.
  • Per-team observability with outlier alerting, since an aggregate is dominated by the many small tenants and blind to the few large ones being broken.
  • Attribution, so consumption has an owner and cost is visible.
  • Priority classes, so critical workloads can preempt batch under pressure.

The promotion path

A measured threshold — consumption, criticality, or a specific isolation requirement — that triggers a move to dedicated capacity, with the migration tooling built and rehearsed.

Discovering the need during an incident, with nothing prepared, is the common and avoidable outcome — and internally it is usually discovered as a team announcing they are leaving the platform.