01
Planner-enforced isolation
Rewrite organization scope into SQL plans so isolation does not depend on stream prefixes.
Solution · Platform engineering
Give every team context without deploying a stack per team.
Use planner-level organization isolation, quotas, audit, roles, and scalable runtime components to serve multiple teams from one telemetry plane.
- organization isolation
- planner-level
- implemented SSO
- OIDC + SAML
- per-org quota dimensions
- 3
- runtime roles
- 6
Controls for a shared internal platform.
Multi-tenancy needs enforcement, identity, limits, and operations—not only a tenant label.
02
Identity and audit
Use JWTs, scoped API tokens, OIDC/SAML, roles, and an audit trail for mutating operations.
03
Quotas and health
Apply per-organization ingest QPS, query QPS, and storage limits with health and Prometheus metrics.
04
Independent runtime roles
Scale routers, ingesters, queriers, compactors, alert managers, and connectors for the workload.
workflow
From local evaluation to a shared service.
The deployment model grows without changing the telemetry model operators learn.
- 101 · Prove
Run the standalone profile
Validate ingest, query, correlation, alerting, and the web UI with one process.
- 202 · Separate
Split stateful ingest from stateless roles
Move to multi-role deployment when throughput or availability requires it.
- 303 · Govern
Add organizations, roles, tokens, and quotas
Give teams bounded access without duplicating the platform.
- 404 · Operate
Monitor the platform itself
Use readiness probes and metrics for WAL, object storage, caches, ingest, and compaction.
proof / shipped
The control plane is part of the current product.
Organization management, IAM, roles, service accounts, quotas, SSO providers, audit, and node views exist in the web and API surfaces.
- OIDC and SAML implemented
- API tokens with role, expiry, and last-used
- Audit log and field-level encryption
- Docker Compose and Kubernetes deployment paths
Solution · Platform engineering
Give every team context without deploying a stack per team.
Use planner-level organization isolation, quotas, audit, roles, and scalable runtime components to serve multiple teams from one telemetry plane.