Two school districts share one SaaS-style deployment of a student s…

Question

Two school districts share one SaaS-style deployment of a student services app. Queries must never return another tenant's student rows even if object IDs are similar. What multi-tenant data pattern should the code enforce?

Accepted Answer

Include tenant identity in keys or query filters and enforce tenant isolation on every data access path — Shared SaaS is a duplex apartment: each district gets its own locks, not a hallway dump of every student's file. Put tenantId in the key or filter and check it on every read — UUIDs alone are not walls.

Answer

Use a single global table scan and filter results in the browser after download

Answer

Rely on obscurity of UUID primary keys without embedding tenant identity in access checks

Answer

Grant every district role DynamoDB full-table Scan so reporting tools stay simple

Two school districts share one SaaS-style deployment of a student services app. Queries must never return another tenant's student rows even if object IDs are similar. What multi-tenant data pattern should the code enforce?

Short Explanation

Full Explanation