Between Friday evening and Monday morning, 30+ pull requests merged across two repositories. The result: Trimio's architecture went from a single-tenant LLM proxy to a fully isolated multi-tenant SaaS platform — Postgres Row-Level Security on every org-scoped table, an org provisioning API, staff portal with audit trail, and an invitation flow that doesn't require a Zoom call.
This post is not a feature announcement. It's an engineering breakdown of what was built and why the isolation model matters for every customer who trusts Trimio with their AI traffic.
Multi-tenant isolation can be done several ways. The options on the table:
Trimio chose RLS. The critical property: RLS is enforced at the database engine level, not in application code. Even if Trimio's Go backend has a bug in a WHERE clause, the RLS policy on the table catches the leak. The isolation is structural, not contractual.
Before RLS can work, every tenant-scoped table needs a clean org identifier. Phase 1 audited 77 grandfathered tables — tables that predated the multi-tenant initiative and weren't guaranteed to have org_id as a hard constraint. Nine PRs followed:
The MCP permission spend fix was the most consequential PR in Phase 1. Org A's tool costs were silently debiting Org B's budget. The fix: composite primary key on (org_id, scope_type, scope_id, server_id, year_month). The bug was structural and invisible without a systematic org-scoping sweep.
Phase 2 delivered the RLS policies themselves — not just the data model, but the enforcement mechanism:
ENABLE ROW LEVEL SECURITY and fires in CI. Going forward, a developer cannot accidentally skip RLS on a new table — the gate fails the build.The control plane is what makes isolation commercially useful:
POST /api/v1/orgs (platform-admin gated) and POST /api/staff/orgs (staff-audited).The UI ships an org switcher in AvatarMenu and a staff org lifecycle panel. The full self-service admin surface is now wired.
Most SaaS companies that implement shared-schema isolation document the requirement and rely on code review to enforce it. The problem: code review is a human process and humans miss things, especially under deadline pressure. The RLS-coverage gate converts a documentation requirement into an automated enforcement mechanism.
The gate runs on every PR. If a developer adds a new table and forgets the RLS policy, the build fails before it can be merged. The isolation guarantee is enforced at the layer that can't be bypassed by a missed review comment.
The enterprise AI governance conversation starts with a question that most AI gateway vendors can't answer precisely: "How do we know our API keys, usage data, and request logs are never accessible to another customer?"
Application-layer filtering answers: "We write good WHERE clauses." Database-level RLS answers: "The database engine enforces the boundary regardless of what the application code does." The difference is not academic — it's the difference between "we believe our code is correct" and "the isolation guarantee holds even if our code has a bug."
The audit log (tenant-aware, under Goose migration, append-only constraint) means every data access is recorded. If a security team ever needs to confirm that org A's traffic never reached org B's records, the answer is in the log — not a confidence interval from code review.
The architectural completion of multi-tenant isolation is a prerequisite for Trimio's internal agent automation: health scoring agents reading request_logs, Finance Report agents running per-org spend queries, CRM logging agents running under the MCP gateway. Until Phase 1 completed, an agent query that missed an explicit WHERE org_id = ? filter could silently return cross-tenant results. With RLS enforced at the engine level, the isolation guarantee is structural — not dependent on every agent query being written correctly.
Trimio went from single-tenant proxy to multi-tenant SaaS platform in one sprint. The isolation model — Postgres RLS with automated CI enforcement, per-org audit log, org provisioning API — is the architecture that enterprise procurement teams require before they put a purchase order in front of their legal department.
The org provisioning API is live. The audit log is live. The RLS-coverage gate is in CI. The path from "prospect inquiry" to "live multi-tenant org with isolated VKs, per-org billing view, and self-serve onboarding" is no longer a Zoom call with an implementation engineer. It's an API call.
Trimio's multi-tenant architecture is available now. If you're evaluating AI gateway vendors for an enterprise deployment, the data isolation model is the first question to ask. See how it's built.