Design a backend for a SaaS product where multiple customer tenants share the same application. How would you enforce isolation?

In production I make tenant isolation testable and observable across API policies, queries, cache keys, object storage, search documents, messages, exports, and background jobs. Audit records capture cross-tenant administrative access and denied attempts without turning ordinary reads into excessive noise. Capacity controls prevent one tenant from exhausting shared pools, and encryption or regional placement follows the product's compliance boundary. If selected customers require stronger isolation, routing can place them on dedicated databases or infrastructure behind the same application contract. The decision is driven by risk, operations, noisy-neighbor behavior, and customer obligations rather than by treating one tenancy model as universally mature.