Several towns share one managed NoSQL service for 311 case documents. How should the platform isolate each town’s data at a basic tenancy level?

When several towns share one managed NoSQL service for 311 case documents, basic tenancy isolation starts by prefixing or partitioning keys with a tenant identifier so each town’s documents stay logically separated in queries and access controls. Shared keys across towns invite accidental merges and cross-tenant reads. Giving every town the same document key so replicas “merge automatically” destroys isolation and corrupts case identity. Disabling authentication so towns share one global collection without filters is a security failure in multi-municipality platforms. Storing all towns under one unkeyed blob sorted only by free-text search provides neither reliable isolation nor predictable access paths. Exam caveat: key prefixing is necessary but not always sufficient—pair it with authz, encryption, and backup scoping per tenant for production civic clouds. Operational check: create cases for two tenant ids, query by partition/prefix, and verify each town’s credentials cannot read the other’s documents in the shared cluster. In production terms for tenant key isolation on shared 311 NoSQL, assign an owning team, wire a dashboard that shows the pattern is healthy under peak civic load, and require a staging drill that rehearses failure and recovery before resident impact. Revisit the choice when traffic shape, retention, or integrity needs change, and keep a named rollback owner on the change record. Re-test both the happy path and the failure path for tenant key isolation on shared 311 NoSQL after material dependency upgrades so regressions are caught before the next public release.