Release and rollback
Internet software talks start at screens and features; the expensive change is identity and integration boundaries. How tenants isolate data, how org rights inherit, how leavers lose access, how public APIs version—if phase one fudges those, a large customer in phase two forces a table rewrite. We draw four edges first: tenant, role, resource, interface. Who sees whose data is a product rule, not “permissions while we are here.” Audit log, login policy, and key rotation enter scope from the real compliance need, not a scan after launch.
APIs and integration
Integration is daily platform work, not a plugin. Payments, SMS, object storage, SSO, a customer’s ERP or IM all have versions and failed retries. APIs have version numbers, a compatibility window, rate limits, and alerts—not a private protocol per partner. How a failed webhook is replayed and how idempotency works must be demonstrable at acceptance, not a sentence that says “supports integration.”
Tenant isolation
Isolation must name a layer: database, schema, or row—cost, operations, and room to customize differ completely. Some customers want a dedicated deploy; others only logical isolation. The design grades customers so one codebase does not verbally promise three isolation models. Billing, quotas, and degrade-on-overage, if this is SaaS, are decided early or ops will run billing in a spreadsheet.
Billing and quotas
SaaS billing, quotas, and degrade-on-overage cannot be an ops spreadsheet. Provision, trial expiry, suspend, and data export need a state machine so finance and support match. Feature flags are per tenant so one customer does not change globals. Audit must answer who saw which row when, especially ID and payment fields. Sandbox and production keys and callback URLs stay separate; docs state the compatibility window.
Tenant-by-tenant rollout
Go-live is tenant grey: internal or one companion customer runs provision, rights, billing, and key integrations, then volume. Docs and a sandbox for integrators beat teaching APIs verbally. Internet software that works lets a new tenant provision on a path, rights changes audit, and external systems integrate by version—not a fork per customer.