Isolation Models
Choosing between logical and physical separation, and working inside whichever you chose.
Overview
This document covers the isolation models available, the failure mode each accepts, how to choose between them, and the practical consequences of working inside a physically isolated system. It is the standard the decision in DR-004 implies.
Why This Exists
The name this document used to carry was "Multi-tenancy", which presumed the answer. That is the point worth making first: isolation is a choice with several options, and the default one is usually adopted without ever being examined. It is also the decision most expensive to revisit. Configuration, release process, key layout, backup strategy and the shape of a whole class of bug are all downstream of it. By the time the consequences are visible it is no longer one decision to revisit, it is all of them.
The models, and the failure each one accepts
Choosing
Working inside logical isolation
Working inside physical isolation
What isolation does not solve
Related Principles· 2
Related Documents· 4
Referenced By· 3
Version History
- v0.1.0
Established. Renamed from the planned "Multi-tenancy", which presumed the answer. Covers the four models and the failure each accepts, how to choose, working inside either, and what isolation does not solve.