Platform work
A platform is a product
with boundaries.
An internal tool serves one organisation. A platform serves many, under one codebase, with data that must not leak between them and prices that must match what each customer actually uses.
Platform checklist
- Tenancy
- Account, workspace, memberWhere every record belongs
- Roles
- Five roles, written downBefore the first screen
- Release
- Rings, not a big bangInternal first, then customers
- Money
- Entitlement, not hopeWhat a plan permits
01Tenancy
Decide where a record lives before writing a query.
Multi-tenancy is not a database setting. It is a decision about ownership that shows up in every table, every permission check and every export.
AccountThe paying entity
WorkspaceWhere work is separated
MemberWho acts, and as what
RuleEnforced in one place
| Isolation option | When it fits | What it costs |
|---|---|---|
| Shared schema | Many small accounts, one product, strict application-level scoping. | One query without a tenant filter is a data breach. Needs tests, not vigilance. |
| Schema per account | Dozens of accounts with heavier customisation and reporting needs. | Migration fan-out; every schema change runs many times. |
| Database per account | Contractual or regulatory separation, or very large accounts. | Operational overhead; connection and backup management. |
| Separate deployment | A single customer who requires an isolated instance. | Version drift. Every release becomes a per-customer event. |
02Roles
Permissions are a table, not a vibe.
Written before the interface, reviewed with the people who will use it, and tested as a matrix rather than clicked through once.
| Role | Account | Members | Workflow | Records | Approve | Export |
|---|---|---|---|---|---|---|
| Owner | Full | Full | Full | All | Yes | Yes |
| Administrator | Billing only | Invite, remove | Configure | All | Yes | Yes |
| Operator | No | No | Use | Assigned | No | No |
| Reviewer | No | No | Use | Assigned | Yes | No |
| External | No | No | No | Own submissions | No | No |
Illustrative structure for a scoped engagement. The real matrix is agreed with you and tested row by row — including the rows that should be refused.
03Release
Customers are not your test group.
A platform releases to rings, each with a different tolerance for surprise. The ring a change enters is decided before it is merged.
Ring 0
Internal
Our own accounts. Broken states are cheap here; that is the point.
Ring 1
Design partners
Named customers who agreed to see changes early, with a direct route to report them.
Ring 2
General
Everyone else. Feature flags off by default; a change is turned on deliberately.
Ring 3
Revert
Flag off, migration rolled back, and the reason written into the release record.
Every row states what the account can and cannot do right now. Support should never have to guess from a screenshot.
04Money
Billing is a rule, and rules need a source.
Entitlements decide what a plan permits; metering decides what it costs. Both need one owner, or the invoice becomes a negotiation.
| Decision | Implemented as | Failure if skipped |
|---|---|---|
| What a plan allows | Entitlement checks at the service boundary, not in the interface. | A hidden button becomes a free feature. |
| What gets counted | Metered events with idempotency keys and a monthly close. | Double-charging, then a credit exercise. |
| Plan changes | Proration rules written before the first upgrade. | Support improvising refunds. |
| Non-payment | Grace period, read-only state, export still available. | A customer locked out of their own records. |
If you already
have a platform
Most platform work here is not a rewrite. It is one of four things: tightening tenancy where it was added late, making permissions testable, replacing a manual release with rings, or getting billing and entitlements to agree with the contract. Each is scoped separately and can stop after any of them.
Next step
Scope before
estimate.
Send the task, the systems it touches and the deadline you are working to. The first reply is a set of questions, not a quote.