Every client, separately governed
One organisation per client, each with its own policy, budget and approved models. Isolation is enforced in the query, so a key from one client gets a 404 on another client's execution — not a 403, which would confirm the record exists.
Explore multi-client →