tenantlayer.io

Roadmap

Work lives in issues, grouped by milestone. This page is the context around them — and how to contribute covers the standard a pull request is held to.

Two of these are more urgent than their milestone suggests

  • Tenant-scoped cache keys — a shared cache is a hole straight through every other isolation layer. A cache hit never reaches the database, so row-level security cannot help. Until this ships, do not put a tenant-scoped result behind @Cacheable without keying it yourself.
  • Schema-per-tenant routing — carries the same search_path leak risk that the connection wiring was built to prevent, and it is the second most requested strategy.

2 issues · listed here because a roadmap that hides its sharp edges is marketing, not a roadmap.

The whole surface

Multi-tenancy is not one feature. Here is every concern it involves, and exactly where we are on each — including the rows that are still empty.

ConcernShipped in 0.1.0Planned
Tenant resolution
  • Header
  • Subdomain
  • Path segment
  • JWT claim
  • Pluggable SPI
  • Ordered chain
  • Strict fail-closed
Context & propagation
  • @Async
  • CompletableFuture
  • Virtual threads
  • @Scheduled
  • Outbound HTTP
  • Kafka produce & consume
  • MDC logging
Isolation strategies
  • Row-level security
  • Hibernate @TenantId discriminator
Authorisation
  • Membership verification — a claimed tenant is checked against the caller
Schema & policies
  • Entity scanning
  • One-shot RLS policy generation
Tenant registry
  • Table-backed registry with status, region, group and metadata
Migrations
Caching
Observability
  • MDC log enrichment
Testing
  • @WithTenant
  • assertTenantCannotSee
  • Testcontainers fixtures
Dashboard

Every planned item is an open issue. 26 of them are unclaimed.

What is not on this list

TenantLayer is open core. Everything above is the free core, and the rule that decides what belongs in it is published:

Free is correctness. Paid is operations, compliance and scale. Would a two-person startup need it before they have customers? Free. Would a team closing their first large enterprise deal need it? Paid.

The free core is never crippled to sell the paid one. If something is needed to build tenancy correctly and it is not here, that is an omission worth an issue — and the rule above is what the argument gets held up against.

Deliberately out of scope entirely: cross-region replication, active-active and failover orchestration. Those belong to the database platform. TenantLayer stays region-aware and never becomes a replication control plane.