Architecting a multi-tenant ResearchOps platform
Multi-tenant design balancing isolation and sharing.
Tenant isolation model, RBAC plus governance and classification, searchable metadata and a taxonomy for cross-team synthesis.
What's really being asked
This is a tenancy-and-governance system design question with a built-in tension: teams want privacy and ownership, while the organization wants cross-team insight. The interviewer looks for an architecture that serves both without leaking sensitive data.
The full answer
Pick a multi-tenancy model: logical isolation with a tenant identifier on shared infrastructure is usually pragmatic, with row-level or schema separation per team, reserving stronger physical isolation for regulated data. Layer access control: role-based and attribute-based permissions scoped per tenant, plus data classification so PII and raw recordings are locked down while synthesized insights can be shared more broadly. Governance includes retention policies, residency for global compliance, consent tracking, and audit logs of access. For discoverability and synthesis, build a searchable metadata catalog and a shared taxonomy or tagging vocabulary so a study in one team is findable by another; expose anonymized insights and themes to an organization-wide layer while keeping underlying personal data tenant-scoped. This lets teams work independently yet enables cross-org synthesis on de-identified findings.
The mistakes people make
Full physical isolation per team, which blocks any cross-organizational synthesis. A single open data pool with no tenant boundaries or PII controls. Treating access control as one global admin role. Ignoring data residency and consent for a global org. Providing storage with no metadata or taxonomy, so nothing is discoverable.
What usually comes next
How do you let teams share insights without exposing raw PII. How does data residency change your tenancy model. How do you keep a shared taxonomy consistent across teams.
A concrete example
The Europe team stores interview recordings and PII in a residency-compliant, tenant-isolated store with strict RBAC. They tag findings against the org-wide taxonomy. When a US team researches the same feature, they search the shared insight catalog and discover the European study's de-identified themes and recommendations, request access if needed, and synthesize across both, all without ever touching the original PII or violating residency, because only anonymized insights crossed the tenant boundary.
Interview question
How does the design enable cross-team synthesis without violating each team's data isolation?
- a.By disabling access control to simplify search
- b.By sharing only de-identified insights and metadata org-wide while keeping raw PII tenant-scopedCorrect
- c.By physically isolating every team so no data is ever shared
- d.By granting all teams full admin access to every tenant
Why? this is the answer
Sharing anonymized insights and a searchable catalog enables synthesis while raw personal data stays isolated; full access or total isolation breaks either governance or the synthesis goal.
Just read this? Test yourself on what you have been reading.
- #system-design
- #multi-tenancy
- #research-ops
- #data-governance
- #access-control
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on system-design — each one lists the topics its interview covers.
See open roles