Scenario 29: A SaaS product wants to guarantee that Company A's users can never see Company B's data, even if both are on the same shared infrastructure.

This calls for tenant isolation enforced through the token itself: embed a tenant_id claim in the JWT/OIDC token at issuance (e.g., a dedicated Keycloak realm per tenant, or a custom claim mapper), and enforce it at BOTH the authorization layer (every query/service method scoped by tenant_id, similar to per-user ownership checks) and, ideally, at the database layer (row-level security or separate schemas) as defense-in-depth beyond just the application code.