Roadmap
Work lives in issues, grouped by milestone. This page is the context around them — and how to contribute covers the standard a pull request is held to.
Breadth
Schema-per-tenant routing, reactive and batch propagation, registry lifecycle, migrations and caching. Most of it is additive, so most of it can be worked on in parallel without colliding.
The one that matters
Database-per-tenant routing and the configuration-driven strategy switch. Together they decide the shape of the isolation abstraction that everything else hangs off, which is why 1.0 comes after this and not before.
Running it in production
Knowing a policy is missing before a customer finds out, and being able to see what the library thinks is going on.
Two of these are more urgent than their milestone suggests
- Tenant-scoped cache keys — a shared cache is a hole straight through every other isolation layer. A cache hit never reaches the database, so row-level security cannot help. Until this ships, do not put a tenant-scoped result behind
@Cacheablewithout keying it yourself. - Schema-per-tenant routing — carries the same
search_pathleak risk that the connection wiring was built to prevent, and it is the second most requested strategy.
2 issues · listed here because a roadmap that hides its sharp edges is marketing, not a roadmap.
The whole surface
Multi-tenancy is not one feature. Here is every concern it involves, and exactly where we are on each — including the rows that are still empty.
| Concern | Shipped in 0.1.0 | Planned |
|---|---|---|
| Tenant resolution |
| |
| Context & propagation |
| |
| Isolation strategies |
| |
| Authorisation |
| — |
| Schema & policies |
| |
| Tenant registry |
| |
| Migrations | — | |
| Caching | — | |
| Observability |
| |
| Testing |
| |
| Dashboard | — |
Every planned item is an open issue. 26 of them are unclaimed.
What is not on this list
TenantLayer is open core. Everything above is the free core, and the rule that decides what belongs in it is published:
Free is correctness. Paid is operations, compliance and scale. Would a two-person startup need it before they have customers? Free. Would a team closing their first large enterprise deal need it? Paid.
The free core is never crippled to sell the paid one. If something is needed to build tenancy correctly and it is not here, that is an omission worth an issue — and the rule above is what the argument gets held up against.
Deliberately out of scope entirely: cross-region replication, active-active and failover orchestration. Those belong to the database platform. TenantLayer stays region-aware and never becomes a replication control plane.