Architecting a multi-tenant ResearchOps platform

WHAT THIS TESTS This is a tenancy-and-governance system design question with a built-in tension: teams want privacy and ownership, while the organization wants cross-team insight. The interviewer looks for an architecture that serves both without leaking sensitive data.

A GOOD ANSWER COVERS Pick a multi-tenancy model: logical isolation with a tenant identifier on shared infrastructure is usually pragmatic, with row-level or schema separation per team, reserving stronger physical isolation for regulated data. Layer access control: role-based and attribute-based permissions scoped per tenant, plus data classification so PII and raw recordings are locked down while synthesized insights can be shared more broadly. Governance includes retention policies, residency for global compliance, consent tracking, and audit logs of access. For discoverability and synthesis, build a searchable metadata catalog and a shared taxonomy or tagging vocabulary so a study in one team is findable by another; expose anonymized insights and themes to an organization-wide layer while keeping underlying personal data tenant-scoped. This lets teams work independently yet enables cross-org synthesis on de-identified findings.

COMMON WRONG ANSWERS Full physical isolation per team, which blocks any cross-organizational synthesis. A single open data pool with no tenant boundaries or PII controls. Treating access control as one global admin role. Ignoring data residency and consent for a global org. Providing storage with no metadata or taxonomy, so nothing is discoverable.

LIKELY FOLLOW-UPS How do you let teams share insights without exposing raw PII. How does data residency change your tenancy model. How do you keep a shared taxonomy consistent across teams.

ONE CONCRETE EXAMPLE The Europe team stores interview recordings and PII in a residency-compliant, tenant-isolated store with strict RBAC. They tag findings against the org-wide taxonomy. When a US team researches the same feature, they search the shared insight catalog and discover the European study's de-identified themes and recommendations, request access if needed, and synthesize across both, all without ever touching the original PII or violating residency, because only anonymized insights crossed the tenant boundary.