Fable
Many trading firms in the same building
The old abacus building initially served only one cloth shop. The ledgers, counter, staff and warehouse all belonged to the same owner, so no matter how they were arranged, nothing got mixed up.
Later the proprietor sold the same accounting service to a dozen trading firms. They shared the hall, errand puppets, reporting engine and backup warehouse, but each had its own customers, prices, contracts and payment terms.
In the first week, to keep things simple, the administrator gave each trading house a folder of a different color. The puppets processed by color, and everything looked orderly.
Soon, a tea merchant's renewal report showed a cloth shop's customer name. The cause was not a hacker, but the report template caching the filter conditions from the previous merchant.
The host first had the clerk check the colors. But there was too much to share: search indexes, logs, queues, scratch notepads, billing tables, temporary files—forget the firm's mark in any one place and the flavors would mix.
The new architect renumbered the entire building. Every request carries tenant identity when it enters, and data, configuration, permissions, quotas, transaction logs, caches, and task queues are all divided by tenant. Shared capabilities can be shared, but boundaries cannot be omitted. The more businesses there are, the more the building owner understands that boundaries are not extra decoration. Tenant identity must follow every data retrieval, ledger write, job scheduling, and billing like a seal; even if the same group of staff is shared behind the scenes, room keys must not be mixed together.
When the errand puppet worked for the tea merchant, it could only see the tea merchant's space; tool calls, knowledge base retrieval, ledger writing, and billing all carried the same tenant marker. The architect also arranged drills. He deliberately had the errand puppet use the tea merchant's key to open the cloth shop's cabinet, and the system had to refuse; he had the report switch between two firms, and the cache had to be cleared again.
The building still ran on one platform, and maintenance costs didn't multiply into a dozen systems. But each business felt like it lived in its own room, with its own keys, bills and rules. The landlord understood: the hard part of multi-tenancy isn't letting many people share one building—it's making the sharing still feel like each has their own secure little building.