“

Series: S12 Developer Tutorials · Article 18 | Level: Intermediate | Reading Time: 15 min

Multi-Tenant Isolation & Configuration Guide

#Introduction

When your coomia-dip platform needs to serve multiple organizations or departments, multi-tenant isolation becomes critical. Each tenant requires independent data spaces, independent Ontology definitions, and independent permission systems, while sharing underlying infrastructure to reduce operational costs.

coomia-dip adopts a "logical isolation + physical sharing" hybrid model: Ontology Schema, data storage, and permission policies are logically isolated, but compute resources of Control Layer, Data Layer, and Intelligence Layer are shared. This tutorial guides you through configuring and managing a multi-tenant platform.

#1. Multi-Tenant Architecture

#1.1 Isolation Model

#1.2 Tenant Identity Propagation

# Method 1: Auto-detected from JWT token containing tenant_id claim
platform = OntoPlatform(base_url="http://localhost:8080", token="eyJ...")

# Method 2: Explicit specification (for admins)
platform = OntoPlatform(base_url="http://localhost:8080",
    token="admin-token", tenant_id="acme-corp")

#2. Creating and Managing Tenants

#2.1 Create Tenant

admin = OntoPlatform(base_url="http://localhost:8080", token="super-admin-token")

tenant = admin.tenants.create(
    tenant_id="acme-corp",
    display_name="ACME Corporation",
    config={
        "max_object_types": 100,
        "max_objects_per_type": 1_000_000,
        "max_concurrent_queries": 50,
        "features": {
            "reasoning_engine": True,
            "ai_functions": True,
            "flink_cdc": False,
        },
    },
    admin_user={"username": "admin@acme.com", "role": "TENANT_ADMIN"},
)

#2.2 Resource Quotas

admin.tenants.set_quota("acme-corp", {
    "cpu_cores": 4, "memory_gb": 16, "storage_gb": 100,
    "api_rate_limit": 1000, "max_users": 50,
})

#2.3 Automatic Data Isolation

When a tenant is created, coomia-dip automatically: creates a Doris database (onto_acme_corp), Kafka topic prefix (onto.acme-corp.*), Ontology namespace (acme-corp), and tenant-level RBAC policies.

#3. Tenant-Level Ontology Management

#3.1 Independent Object Type Definitions

Each tenant defines their own Object Types independently:

acme.ontology.create_object_type(
    name="Order",
    properties={
        "orderId": {"type": "STRING", "primary_key": True},
        "internalCode": {"type": "STRING"},  # ACME-specific field
    },
)

#3.2 Shared Templates

admin.ontology.create_template(name="StandardOrder", properties={...})
acme.ontology.create_from_template(
    template="StandardOrder", name="Order",
    additional_properties={"internalCode": {"type": "STRING"}},
)

#4. Cross-Tenant Data Sharing

#4.1 Sharing Agreements

admin.tenants.create_sharing_agreement(
    provider_tenant="acme-corp",
    consumer_tenant="beta-inc",
    shared_object_types=["Product"],
    shared_properties=["productId", "productName"],
    access_mode="READ_ONLY",
)

#4.2 Federated Queries

beta.oql.execute("SELECT p.productId FROM acme-corp::Product p WHERE p.category = 'Electronics'")

#5. Monitoring & Governance

#5.1 Usage Monitoring

usage = admin.tenants.get_usage("acme-corp")
print(f"Storage: {usage.storage_used_gb:.1f} / {usage.quota.storage_gb} GB")
print(f"API Calls (today): {usage.api_calls_today}")

#5.2 Cost Allocation

report = admin.tenants.get_cost_report("acme-corp", period="2025-03")
print(f"Estimated cost: ${report.estimated_cost:.2f}")

#5.3 Tenant Lifecycle

admin.tenants.suspend("acme-corp", reason="Payment overdue")
admin.tenants.activate("acme-corp")
admin.tenants.archive("acme-corp")
admin.tenants.delete("acme-corp", confirm_phrase="DELETE acme-corp PERMANENTLY")

#6. Security Best Practices

• Network isolation: gRPC requests routed via X-Tenant-ID header
• Token validation: Server verifies token tenant_id matches request tenant_id
• Query injection: Database queries auto-inject tenant filter conditions
• Audit logging: All tenant operations recorded
• GDPR compliance: Data export capability per tenant

#Summary

This tutorial covered coomia-dip multi-tenant management: tenant creation and quotas, independent Ontology management, cross-tenant data sharing, usage monitoring and cost allocation, security auditing and compliance exports. Multi-tenant isolation is a core PaaS capability, enabling secure service to multiple organizations on shared infrastructure.

Next: [S12-19] Production Deployment Checklist Previous: [S12-17] OSDK TypeScript Frontend Integration Guide