Host-derived tenancy
The subdomain resolves context. A path segment never selects a tenant.
Case study · Carbon
Tenant one, without tenant-one shortcuts.
Carbon is Deck's first client tenant and reference implementation. It was provisioned by hand; the product boundary is still the same one intended for every future client.
Serving tenant
What is true now
The apex carries no tenant data. Carbon lives on its own subdomain, the request host resolves the tenant context, and tenant-owned rows are protected by database row-level policies.
- Client
- Carbon
- Role
- Tenant #1
- Workspace
- carbon.davidcookscode.com
- Tenant grain
- One client brand
Architecture before decoration
Two kinds of separation
Tenant isolation keeps one client brand from another. Module boundaries keep a handled problem in one capability from taking down its siblings.
Database enforcement
Tenant-owned records carry a tenant and PostgreSQL policies enforce the wall.
Bulkheaded modules
Capabilities publish contracts instead of reaching into one another's storage.
Implemented surface
The capability map
Crew
People, organisation and access-linked employee records.
ImplementedPay
Payroll runs and Malaysian statutory inputs in integer sen.
ImplementedCareers
Public roles, applications, verification and hiring pipeline.
ImplementedFlow
Guests, reservations, feedback and sales ingestion.
ImplementedDocs & Seal
Private files, recipients and recorded sealing events.
ImplementedUse the same discipline on a different operation.
The first conversation is about boundaries, existing records and the work that repeatedly fails.