Operant Labs

Mobile application

The challenge

Operant had product-market fit and a growing pipeline it could not close. Every enterprise deal stalled at security review: no SSO, no SCIM provisioning, no audit log, and a database schema where tenant separation was enforced in application code rather than at the data layer — a fact that a single competent security reviewer found immediately. Sales had lost seven deals in twelve months for reasons that were entirely architectural.

Research

• Post-mortem interviews on all seven lost enterprise deals
• Review of 23 completed security questionnaires to identify recurring blockers
• Schema audit identifying every query path lacking tenant scoping
• Benchmarking against SOC 2 Type II and ISO 27001 control requirements

The solution

Tenant isolation moved from application code into PostgreSQL row-level security, so a query that forgets its tenant scope returns nothing rather than everything — a failure mode that fails safe. SSO and SCIM shipped as configurable product features rather than per-customer integrations. Usage metering was rebuilt as an event pipeline with reconciliation guarantees, replacing an aggregation job that had been quietly under-billing by a low single-digit percentage.

UX decisions

Features

• Row-level tenant isolation enforced in PostgreSQL
• SAML and OIDC SSO with self-serve configuration
• SCIM 2.0 user and group provisioning
• Immutable audit log with export and retention policies
• Usage metering reconciled to invoice at the cent
• Per-tenant performance guarantees with query governance
• Customer-facing usage and cost dashboards

Technology

Architecture

A GraphQL gateway resolves tenant context from the session and sets the PostgreSQL session variable that drives row-level security policies — application code cannot bypass it. Metering events flow through an append-only pipeline into a daily reconciliation job that reconciles to the billing system, alerting on any variance above one cent. Redis caches tenant configuration with explicit invalidation on change. Terraform manages the AWS estate; per-tenant query governance sits at the gateway, so a single tenant's expensive query cannot degrade another's experience.

Results

Eleven previously-stalled enterprise deals closed in the two quarters following launch. Average security review time fell 73%, from 41 days to 11. The metering rebuild surfaced and corrected historical under-billing, adding measurable recurring revenue that had been silently leaking. Operant achieved SOC 2 Type II certification four months after the compliance work shipped.

Lessons learned

1. 01Enforcing isolation at the data layer rather than in application code was worth the migration cost several times over — it converted a class of catastrophic bug into an impossible one.
2. 02The lost-deal post-mortems were more valuable than any requirements document. Sales knew exactly what was blocking them; nobody had systematically asked.
3. 03Building audit logging as a usable product feature rather than a compliance checkbox meant it got used, which in turn made it battle-tested before any auditor examined it.