Multi-tenant isolation

Product guide: what the capability brings, for whom, its limits and the version that delivered it - no configuration syntax.

Developer side: Getting credentials; operations side: Wiring your identity provider, Setting quotas.

The tenant is an API's end customer: a company, a team, an account. Flexway reads it from a verified source and enforces it everywhere, not only in routing.

Where	What is guaranteed
Identity	The tenant comes from a signed claim, an API key, a certificate or a trusted mesh; the value the client writes never reaches the upstream
Quotas and budgets	Counted per tenant: a tenant never spends another's quota
Cache	An authenticated response is cached per tenant and per person; isolation test on every PR
Asynchronous plane	A subscriber reads its tenant only; a channel can be bound to one person
Native Kafka	A virtual cluster per tenant; no other tenant's name, neither in an answer nor toward the broker; proven by mutation on every PR
Encryption	An encrypted field is bound to its tenant, topic and path: copied elsewhere, it does not decrypt
Console	An account bound to a tenant sees that tenant only; elsewhere, 403

Limit: the isolation is logical, inside a shared gateway; physical isolation means deploying one gateway per customer.