The shift-left bet
In software, "shift left" usually means catching defects earlier. In Eelgrass it means moving hard multi-tenant problems out of every SaaS team's business layer and into the database. Isolation, audit, residency, and migration orchestration live in the engine. Application code owns domain logic.
Work that usually stays in the app
Two industry defaults both push work onto application and ops teams:
| Default | What you get | What you still own |
|---|---|---|
Shared schema + tenant_id | One cheap database | Isolation as a filter; noisy neighbors; compliance anxiety |
| Database-per-tenant | Stronger isolation | Provisioning, routing, placement, per-tenant migrations, fleet ops |
Eelgrass's third path: the tenant is an engine primitive. Queries are tenant-scoped by default. Cross-tenant work is explicit (CDC + sagas). Accidental cross-tenant joins do not exist as a query path.
What actually shifts left
| Concern | Usual app / ops work | Engine / language surface |
|---|---|---|
| Isolation | tenant_id middleware, RLS footguns | Implicit tenant scope on every query |
| Consistency | Fragile "distributed transaction" hopes | Tenant-scoped atomic { … } only |
| Migrations | Nightly jobs across thousands of DBs | Schema @vN + lazy fingerprint apply-on-touch |
| Audit / restore | Custom audit tables + backup glue | Versioned pages, named snapshots, asof |
| Environments | Dump/restore anonymized clones | fork tenant copy-on-write |
| Cross-tenant reads | Weak shared tables | Per-tenant CDC into disposable indexes |
| Money integrity | Float bugs and silent currency mixups | Money as a real type (minors + currency) |
Roadmap items that are declared in the catalog but not yet enforced as a full control plane (residency routing, encryption materialization, cloud backends) still belong to the engine doctrine. They stay out of per-product glue by design. See the capability map.
Before / after for a typical SaaS write path
Why this is a business architecture decision
Technical teams feel the shift as fewer platforms to maintain. Business stakeholders feel it as:
- Lower breach class risk. Every query is tenant-scoped.
- Faster customer environments. Fork a tenant for a support or staging copy.
- Migration that scales with access, not fleet size. Idle tenants do not pay until first touch.
- Audit history on the write path. History is pages + WAL.
Deeper plain-language framing: Value for the business. Honest maturity: Capability map and Status.