The shift-left bet
In software, "shift left" usually means catching defects earlier. In Eelden it means something sharper: move the hard multi-tenant problems out of every SaaS team's business layer and into the database, so product engineers keep shipping features instead of reinventing isolation, audit, residency, and migration orchestration.
The pain Eelden refuses to leave in your app
Two industry defaults both push work right — onto application and ops teams:
| Default | What you get | What you still own |
|---|---|---|
Shared schema + tenant_id | One cheap database | Isolation as a filter; noisy neighbors; compliance anxiety |
| Database-per-tenant | Stronger isolation | Provisioning, routing, placement, per-tenant migrations, fleet ops |
Eelden's third path: the tenant is a first-class engine primitive. Isolation is the zero-config case. Cross-tenant work is explicit (CDC + sagas), never an accidental join.
What actually shifts left
| Concern | You stop reinventing | Engine / language surface |
|---|---|---|
| Isolation | tenant_id middleware, RLS footguns | Implicit tenant scope on every query |
| Consistency | Fragile "distributed transaction" hopes | Tenant-scoped atomic { … } only |
| Migrations | Nightly jobs across thousands of DBs | Schema @vN + lazy fingerprint apply-on-touch |
| Audit / restore | Custom audit tables + backup glue | Versioned pages, named snapshots, asof |
| Environments | Dump/restore anonymized clones | fork tenant copy-on-write |
| Cross-tenant reads | Weak shared tables | Per-tenant CDC into disposable indexes |
| Money integrity | Float bugs and silent currency mixups | Money as a real type (minors + currency) |
Roadmap items that are declared in the catalog but not yet enforced as a full control plane (residency routing, encryption materialization, cloud backends) still belong to the engine doctrine — not to a future pile of per-product glue. See the capability map.
Before / after for a typical SaaS write path
Why this is a business architecture decision
Technical teams feel the shift as fewer platforms to maintain. Business stakeholders feel it as:
- Lower breach class risk — isolation is not a forgotten
AND tenant_id = - Faster customer environments — fork a tenant instead of provisioning theater
- Migration that scales with access, not fleet size — idle tenants do not pay
- Auditability that falls out of storage — history is pages + WAL, not a side table you forgot to write in one code path
Deeper plain-language pitch: Value for the business. Honest maturity: Capability map and Status.