saas-multi-tenant

SaaS Multi-Tenant Expert (2026 Edition)

English | Bahasa Indonesia

---

English

Orchestration & Integration

Connects and orchestrates with relevant domain skills like brainstorming, zero-to-prod-orchestrator, and project-context-mapper to ensure cohesive execution.

Description

Expert guide for designing and implementing multi-tenant SaaS architectures with full tenant isolation, Supabase/PostgreSQL Row Level Security (RLS), schema-per-org patterns, RBAC, and Super Admin access controls.

Trigger Conditions

• Building a SaaS application that serves multiple organizations (workspaces/tenants).
• Implementing Row Level Security (RLS) policies in Supabase or PostgreSQL.
• Designing a data model that isolates tenant data securely.
• Implementing role-based access control (RBAC) within a tenant.
• Building the Super Admin management panel for cross-tenant operations.
• Choosing between shared schema vs. schema-per-org isolation strategies.

Tenant Isolation Strategies

Strategy	Isolation Level	Cost	Complexity	Best For
Shared Schema + RLS	Row-level	Low	Medium	Standard SaaS (< 1M tenants)
Schema per Org	Table-level	Medium	High	Compliance-heavy (HIPAA, finance)
DB per Org	Database-level	High	Very High	Enterprise, regulated industries

Strategy 1: Shared Schema + RLS (Recommended for Most SaaS)

Core Schema Design

-- Central workspaces (tenants) table
CREATE TABLE workspaces (
    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    name        TEXT NOT NULL,
    slug        TEXT UNIQUE NOT NULL,
    plan        TEXT NOT NULL DEFAULT 'free' CHECK (plan IN ('free', 'pro', 'enterprise')),
    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
);

-- Users belong to multiple workspaces via memberships
CREATE TABLE workspace_members (
    workspace_id    UUID REFERENCES workspaces(id) ON DELETE CASCADE,
    user_id         UUID REFERENCES auth.users(id) ON DELETE CASCADE,
    role            TEXT NOT NULL DEFAULT 'member' CHECK (role IN ('owner', 'admin', 'member', 'viewer')),
    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
    PRIMARY KEY (workspace_id, user_id)
);

-- All tenant data has workspace_id
CREATE TABLE projects (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    workspace_id    UUID NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
    name            TEXT NOT NULL,
    created_by      UUID REFERENCES auth.users(id),
    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
);