How do I install the Multi Tenancy skill?

Run npx skillmds@latest add rrezartprebreza/multi-tenancy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Multi Tenancy safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Multi Tenancy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Multi Tenancy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Multi Tenancy?

rrezartprebreza (@rrezartprebreza) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Multi Tenancy by rrezartprebreza — Agent Skill

Name: Multi Tenancy
Author: rrezartprebreza

File contents

Multi-Tenancy

Treat tenant identity as an authorization boundary, not a query convenience.

Choose an isolation model

Database per tenant: strongest isolation and highest operational cost.
Schema per tenant: strong logical isolation with shared infrastructure.
Shared schema with tenant_id: simplest operations, but every access path must enforce scope.
Document the selected model and prohibit repositories from bypassing it.

Resolve tenant identity

Derive the tenant from a verified token claim, trusted host mapping, or authenticated API key.
Reject missing, unknown, disabled, or conflicting tenant identifiers.
Never trust a public X-Tenant-Id header by itself.
Clear servlet thread-local context in finally; use Reactor Context for reactive flows.

Enforce isolation

Apply tenant selection before opening the persistence session or transaction.
Include tenant identity in unique constraints, cache keys, idempotency keys, and object storage paths.
Prevent cross-tenant joins and unrestricted administrative repositories.
Authorize support impersonation explicitly and audit every use.

Operations

Run migrations per database/schema with resumable progress and version reporting.
Propagate tenant identity into scheduled jobs, messages, and async tasks explicitly.
Limit noisy tenants with quotas and per-tenant observability using bounded identifiers.
Test negative cross-tenant access, not only successful tenant queries.

Examples

See examples/good-tenant-filter.java and examples/bad-tenant-filter.java.

Gotchas

Agent trusts a tenant header supplied by the caller - derive tenant from authenticated context.
Agent forgets to clear a servlet ThreadLocal - pooled threads can leak one tenant into another request.
Agent scopes database queries but not cache keys - cached data can cross tenants.
Agent starts a transaction before selecting the tenant - routing may choose the wrong database.
Agent runs background jobs without tenant context - make tenant an explicit job parameter.

---name: multi-tenancydescription: Use when implementing tenant resolution, database or schema isolation, tenant-aware JPA, reactive tenant context, migrations, caching, jobs, or authorization in Spring Boot 3.---# Multi-TenancyTreat tenant identity as an authorization boundary, not a query convenience.## Choose an isolation model- Database per tenant: strongest isolation and highest operational cost.- Schema per tenant: strong logical isolation with shared infrastructure.- Shared schema with `tenant_id`: simplest operations, but every access path must enforce scope.- Document the selected model and prohibit repositories from bypassing it.## Resolve tenant identity- Derive the tenant from a verified token claim, trusted host mapping, or authenticated API key.- Reject missing, unknown, disabled, or conflicting tenant identifiers.- Never trust a public `X-Tenant-Id` header by itself.- Clear servlet thread-local context in `finally`; use Reactor `Context` for reactive flows.## Enforce isolation- Apply tenant selection before opening the persistence session or transaction.- Include tenant identity in unique constraints, cache keys, idempotency keys, and object storage paths.- Prevent cross-tenant joins and unrestricted administrative repositories.- Authorize support impersonation explicitly and audit every use.## Operations- Run migrations per database/schema with resumable progress and version reporting.- Propagate tenant identity into scheduled jobs, messages, and async tasks explicitly.- Limit noisy tenants with quotas and per-tenant observability using bounded identifiers.- Test negative cross-tenant access, not only successful tenant queries.## Examples- See `examples/good-tenant-filter.java` and `examples/bad-tenant-filter.java`.## Gotchas- Agent trusts a tenant header supplied by the caller - derive tenant from authenticated context.- Agent forgets to clear a servlet `ThreadLocal` - pooled threads can leak one tenant into another request.- Agent scopes database queries but not cache keys - cached data can cross tenants.- Agent starts a transaction before selecting the tenant - routing may choose the wrong database.- Agent runs background jobs without tenant context - make tenant an explicit job parameter.

Frequently asked questions

Multi Tenancy