A multi-tenant data plane where tenant isolation is structural, not a convention.
Wiring a web app to Postgres is easy. Making that database safe to share across tenants — so one tenant physically cannot read or rewrite another's rows, every audited action is immutable, and a new table can't quietly ship without isolation — is the hard part teams rebuild (and get subtly wrong) over and over. This package is that hard part, as one drop-in facade plus four reference migrations and a CI gate.
TenantDataPlane wires the request → tenant-isolation flow in one place, in order:
- Authenticate — resolve a presented credential to a tenant id. Two trust models at the same door: a bearer JWT (verified; tenant pulled from a configurable claim) or a machine-to-machine API key (
<prefix>:<token>, O(1) lookup + constant-time hash compare). An authenticated identity is the only thing that can bind a request — a client-supplied tenant string never is. - Open a tenant-scoped connection — every connection issues
SELECT set_config('<guc>', '<tenant_id>', true)on checkout, so the row-level-security policies fire for the rest of the transaction. The tenant id is a bind parameter, never interpolated into SQL. - Govern the schema — apply checksum-tracked, resume-on-failure migrations so the schema (and its RLS policies) is versioned and immutable, not hand-rolled.
- Gate RLS coverage — answer "which tenant-scoped tables lack FORCE RLS, minus a documented allow-list?" so a new un-forced table is a failing CI gate, not a silent leak.
Most stacks give you step 0 (connect to the database) and leave 1–4 to careful coding — a WHERE tenant_id = ... here, a hopefully-correct migration there, isolation that holds only as long as every query and every new table remembers the rules. Here those properties are load-bearing structure at the database: isolation is a FORCEd RLS policy that binds even the table owner; auditability is a BEFORE UPDATE OR DELETE trigger that makes recorded rows physically immutable; the dual-path policy lets a backend (bound GUC) and an SDK-direct client (verified JWT claim) reach the same row safely; and a coverage gate turns a forgotten FORCE into a red build. Fork this and your product inherits provable cross-tenant isolation, immutable audit, and migration governance on day one. See docs/MOAT.md.
DOMAIN-NEUTRAL. Nothing here is tied to a product or industry. The GUC name, the JWT claim path, the auth header, the table names, the tenant-discriminator column, and the FORCE-RLS allow-list are all settings or caller-supplied — neutral defaults (app.current_tenant_id, app_metadata.tenant_id, X-Tenant-API-Key) match a stock Supabase project, and every one is overridable. "tenant", "RLS", and "row-level security" are the only domain language, and they are the point.
pip install -e . # the data plane itself needs zero third-party deps (Python 3.9+)
pip install -e ".[jwt]" # optional: real JWT verification (python-jose + httpx)
pip install -e ".[apikey]" # optional: real bcrypt hashing for API keys
pip install -e ".[postgres]"# optional: a real psycopg connection pool + migration adapterimport asyncio
from compliance_data_plane import TenantDataPlane, InMemoryConnection, reference_migrations_dir
# (verifier / key_resolver / connection_adapter are injectable seams — fakes in
# tests, real python-jose / bcrypt / psycopg backends in production.)
plane = TenantDataPlane(
token_verifier=my_jwt_verifier, # or omit for API-key-only
key_resolver=my_key_store.resolve, # or omit for JWT-only
connection_adapter=my_pg_adapter, # needed to open a scoped connection
)
async def main():
resolved = plane.authenticate_jwt("Bearer <jwt>") # -> ResolvedTenant(tenant_id=...)
with plane.persistence_for(resolved).connection() as conn:
... # every query here is RLS-isolated
# govern the schema (the four reference templates + your own dirs)
report = plane.run_migrations(InMemoryConnection(), [(reference_migrations_dir(), "reference")])
# CI gate: any un-forced tenant table (minus the allow-list) is an offender
offenders = TenantDataPlane.rls_offenders(tenant_tables, forced_tables, allowlist)
asyncio.run(main())A full runnable demo (JWT auth, the SET LOCAL binding, API-key auth, the reference migrations, and the coverage gate) is in examples/minimal/quickstart.py — no heavy dependency, no database.
migrations/ ships four domain-neutral TEMPLATES that are the moat made concrete (also shipped inside the wheel, reachable via reference_migrations_dir()):
| File | What it establishes |
|---|---|
001_tenants.sql |
the tier-1 tenants registry (the one cross-tenant system table) |
002_tenant_records_dual_path_rls.sql |
a per-tenant table with dual-path RLS — coalesce(bound GUC, verified JWT claim) |
003_force_rls.sql |
the FORCE ROW LEVEL SECURITY stanza (binds the owner/service role too) |
004_append_only_audit_trigger.sql |
an append-only audit ledger (a BEFORE UPDATE OR DELETE trigger that RAISEs) |
This is a composition spine — it vendors five standalone MIT primitives (under src/compliance_data_plane/_vendor/, see VENDORED.md) and wires them: supabase-fastapi-tenancy (JWT → tenant) + fastapi-tenant-apikey (API key → tenant) at the edge, pg-tenant-persistence (the GUC-binding scoped connection) at the core, idempotent-sql-migration-runner (migration governance) and pg-rls-coverage-gate (the CI gate) around it. Each is independently forkable; this repo is the working assembly.
MIT — see LICENSE.
Powerweave Skunkworks is the AI R&D division of Powerweave Software Services — a rapid-innovation lab that turns real-world product feedback into working, reusable, open-source building blocks. Working in parallel to the main engineering backlog, a lean, cross-functional team of product and technology specialists (UX, data, software engineering, and AI) fast-tracks high-priority ideas into validated modules ready for full-scale build-out.
compliance-data-plane is one such building block — a de-domained, MIT-licensed, dependency-light component extracted from Powerweave's internal R&D and engineered to be forked into any SaaS or enterprise product.
- 🧪 Powerweave Skunkworks on GitHub — https://github.com/skunkworks-powerweave
- 🌐 Powerweave — https://powerweave.com
- 💼 Powerweave on LinkedIn — https://www.linkedin.com/company/powerweave
Powerweave Software Services Pvt. Ltd. is a digital-transformation company founded in 2001 and headquartered in Mumbai, India. With 25+ years of experience, 1,700+ professionals, and 350+ global customers, Powerweave builds platforms, processes, and teams across enterprise eCommerce, AI-powered procurement, Microsoft Dynamics ERP, business services, and sustainability — with a strong focus on cutting-edge AI automation that streamlines workflows, reduces manual errors, and accelerates decision-making. Powerweave is ISO 27001:2013 certified.
Explore Powerweave
- 🌐 Website — https://powerweave.com
- 💼 LinkedIn — https://www.linkedin.com/company/powerweave
- 𝕏 Twitter / X — https://twitter.com/powerweave
▶️ YouTube — https://www.youtube.com/channel/UCE1t_rg38z4n5BAg29PDZFA- 📘 Facebook — https://www.facebook.com/PowerweaveSoftwareSolutions/
- 🛒 Enterprise eCommerce — https://www.powerweave.com/solutions/enterprise-ecommerce/
- 📦 AI-Powered Procurement — https://www.powerweave.com/solutions/procurement/
- 🧮 Microsoft Dynamics ERP — https://www.powerweave.com/solutions/microsoft-dynamics-erp/
- 🌱 Snowkap — Sustainability — https://www.snowkap.com/
- 🎨 Powerweave Studio — https://www.powerweavestudio.com/
- 🧑💼 About Us & Leadership — https://www.powerweave.com/about-us/
- 🚀 Careers — https://www.powerweave.com/careers/
Keywords: multi-tenant · tenant-isolation · row-level-security · rls · postgres · migrations · fastapi · audit · compliance · Powerweave · Powerweave Skunkworks · AI R&D · open source · MIT · Python · forkable.