Control where tenant information is processed and retained, and prevent cross-tenant access across every derived artifact and operational surface.
Residency governs permitted locations for processing, storage, replication, and access under an organization's applicable obligations. Tenant isolation governs separation between customers or organizational units. They intersect but are not interchangeable: two tenants in one region still need isolation, while one tenant's logs or backups can cross a residency boundary accidentally.
Map the complete data path, including prompts, embeddings, caches, traces, evaluation samples, support exports, and disaster-recovery copies. A regional database setting alone does not constrain model endpoints or telemetry. The enforcement design must account for identity, routing, storage partitions, encryption keys, and operator access.
A proof of concept should use synthetic tenants and document every processor and artifact rather than assuming deployment region covers the whole workflow.
Production requires authenticated tenant context, location-aware routing, scoped retrieval, partitioned caches, controlled telemetry, and tested backup and failover behavior.
Enterprise scale adds per-tenant policy variants, regional capacity planning, key ownership, support-access controls, migration procedures, and evidence that derived stores honor the same boundaries.
Defines allowed processing regions, service classes, retention rules, and isolation requirements.
Derives tenant scope from authentication and selects only policy-compatible runtime and model endpoints.
Enforce tenant scope in relational, object, vector, cache, and workflow stores.
Applies minimization, access control, and permitted storage locations to traces and operational records.
Validates that replicas, backups, failover targets, and export jobs remain within approved policy.
flowchart LR
I["Authenticated tenant"] --> P["Tenant location policy"]
P --> R["Permitted execution router"]
R --> M["Allowed model endpoint"]
R --> D["Tenant-scoped data stores"]
R --> T["Regional telemetry"]
P --> B["Approved backup and failover"]
D --> B
T --> BBind the request to authenticated tenant identity and load the current policy version before retrieval or model selection.
Filter runtime, model, and tool endpoints by processing-location and isolation requirements, failing closed if none qualify.
Enforce tenant and resource predicates in every store, including caches and derived search indexes.
Send only necessary data and route logs, traces, and artifacts through compatible regional pipelines.
Check backups, asynchronous jobs, evaluation exports, and operator access against the same tenant policy.
Perform migrations or disaster recovery only through approved destinations with verified cleanup and policy transition records.
Enterprise software · Illustrative enterprise scenario, not a reported customer outcome.
Illustrative architecture: A software provider serves customers whose approved processing regions and support-access rules differ.
The main database is regional, but shared embeddings, global logs, and a fallback model can move customer content outside the intended boundary.
Apply the tenant's policy to every processing and derived-data path, including failure recovery.
A policy router selects regional runtimes and model endpoints; all stores require authenticated tenant keys and telemetry remains in the permitted pipeline.
The preferred model endpoint fails; the router returns a controlled degraded response because the available alternative violates the tenant's location policy.
Measure blocked cross-boundary attempts, data-path coverage, policy-compatible availability, and isolation test results; architecture controls alone do not establish legal compliance.
| Decision | Benefit | Cost |
|---|---|---|
| Dedicated tenant infrastructure | Provides a stronger operational separation boundary. | Raises cost and fleet-management overhead. |
| Shared infrastructure with strict policy | Improves utilization and standardization. | Requires comprehensive enforcement and careful noisy-neighbor management. |
| Residency-constrained failover | Preserves approved location boundaries during outages. | May reduce available recovery capacity or increase downtime. |
Detect: Isolation tests return a cached answer derived from another tenant's material.
Recover: Disable the affected cache, investigate exposure, and rebuild entries with enforced tenant-aware keys.
Detect: Recovery preflight rejects the destination against tenant policy.
Recover: Use an approved recovery target or report constrained availability without silently moving data.
Inventory models, embeddings, logs, backups, support tools, and evaluation exports.
Derive tenant context from authenticated application claims and verify it downstream.
Enforce access and partition boundaries even when all stored data is encrypted.