What platform engineers manage around it

Isolation is enforced for you, but you operate the surface around it. Key points:

• Tenant provisioning stands up the identity realm, the database role and schema, the Kubernetes namespace, and the secrets path as one saga with automatic rollback on failure. You operate that flow; you do not hand-stitch it.
• Know which component runs as the tenant-scoped role and which runs with broader scope, and why. The application path runs scoped; some platform-level work (cross-tenant reads, provisioning) is deliberately broader and audited.
• When you debug an "empty surface" or a "permission denied", check the tenant context first. Most isolation surprises are the boundary doing its job.