Top 9 Multi tenancy Interview Questions
Browse 9 real-world technical and behavioral interview questions about Multi tenancy. Review scenarios, edge cases, and architectural best practices.
Rate-limit an LLM gateway where one request can cost a hundred times another.
Rate limiting an LLM gateway by request count fails because cost is tokens, and output tokens are unknown at admission. Budget tokens per tenant, reserve input plus expected output, settle against reported usage when the stream ends, cap concurrent streams, and cancel upstream on disconnect.
A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.
Treat it as a confirmed breach until proven otherwise: preserve logs, scope who saw what, and start the disclosure clock alongside the investigation. The cause is almost always tenant scoping living in application code, where one forgotten filter leaks everything - so move enforcement below the code, to row-level security.
One tenant bursts to ten times their normal traffic and every other customer's latency doubles. Your global rate limit was never hit. How would you design for fairness instead?
A global limit protects the service from overload but says nothing about how capacity is divided, so one tenant can consume most of it while staying under the ceiling. Fairness needs per-tenant accounting: a token bucket for the steady-state contract, a concurrency limit so expensive requests cannot hog workers, and round-robin queueing so a burst queues behind itself.
A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?
Permission data is as privileged as the code that reads it, so a bulk write to it needs the same review, staged rollout and reversibility as a deploy. Derive grants from a source of truth rather than stamping them, assert tenant invariants continuously, and know how long a cached decision keeps the mistake alive.
How do you isolate tenants in a shared vector index?
Choose between an index per tenant, per-tenant namespaces and one filtered index by weighing recall, blast radius and per-tenant fixed cost. Partitioning turns tenant selectivity from a search-quality problem into a routing decision, which is the argument most candidates miss.
Customers want per-project roles rather than one global role. How do you model that, and where in the request does the check happen?
Model permission as a relationship between a subject, a role and a specific resource, not as a role stamped on the user, and push the check down into the data access predicate so a list query and a single-record fetch are authorised by the same rule.
Would you use iptables or eBPF for network policy enforcement in a massive multi-tenant Kubernetes cluster, and what are the operational trade-offs?
eBPF-based Kubernetes network policy can enforce hard multi-tenancy with faster identity-aware checks than long iptables chains, but it demands verifier-safe rollouts, fail-closed controls, and strong policy observability.
Tenants share one cluster and the largest is a thousand times the smallest. How do you place them?
Multi-tenant placement at scale should use measured resource cost, not tenant count. Keep the long tail in shared pools, move heavy tenants to reserved or dedicated capacity, and design tenant migration as a normal operation because every placement decision ages quickly.
Your largest customer costs more to serve than they pay you. What do you do about that architecturally?
Earn the right to the claim by attributing infrastructure cost per tenant, then separate cost caused by their usage shape from cost caused by your own design. Architecture can change the shape; the decision about who pays is commercial, and it needs the engineering evidence to happen at all.