Multi-tenant by schema, not by a WHERE clause

The quickest way to make a platform multi-tenant is to add a `tenant_id` column to
every table and a matching condition to every query. It works, it ships fast, and it
is one forgotten `WHERE` clause away from showing one company another company’s call
recordings.

The failure mode is worth stating plainly, because it is not exotic. A new report
gets written under time pressure. A join is added to an existing query. Someone
debugs an issue with the filter temporarily removed and the change survives review
because the diff looks harmless. None of these are incompetence; they are the normal
texture of a codebase with more than one person in it. A design where correctness
depends on nobody ever forgetting is a design that will eventually be forgotten.

Structural isolation changes what a mistake costs. When each tenant has its own
schema, a query written without the right scope does not return someone else’s rows
— it fails, loudly, in development. The guarantee moves out of code review and into
the shape of the system.

Voice adds a second surface that pure-software products do not have: the call path
itself. Outbound calls select a trunk belonging to the caller’s own realm, so a
misconfiguration cannot route one company’s traffic over another’s carrier
relationship. Recordings and transcripts inherit the same boundary, which matters
because a recording is often the most sensitive artefact a business holds — a
customer saying their address and order history out loud.

The same reasoning applies to the knowledge base. If document embeddings are
computed by an external service, each upload is a copy of the customer’s private
material leaving their boundary. Computing them in-house is slower to build and
removes an entire category of conversation with a customer’s security team.

The cost is real: schema-per-tenant makes migrations more work and demands
automation early. The benefit is that the question “could tenant A ever see tenant
B’s data?” has a structural answer instead of a procedural one. On a platform
holding recorded customer conversations, that is the right trade.