Design the front-door gateway for a large multi-tenant B2B platform whose core job is to keep tenants isolated from one another. Every request must be tied to exactly one tenant, routed to that tenant's data, and prevented from ever touching another tenant's — while one heavy tenant must not be able to starve the others of capacity.

Operating context. Tenants range from tiny to enormous and share a common serving fleet, but their data lives in per-tenant or per-shard stores. The gateway authenticates each request, resolves its tenant, and enforces that tenant's resource limits so a noisy neighbor's traffic spike cannot degrade everyone else. A cross-tenant data leak is the worst possible failure and must be structurally hard, not merely discouraged. Tenants are onboarded and offboarded continuously, and that must happen without downtime for anyone else.

Out of scope. The identity provider that issues credentials, the application/business services behind the gateway, per-tenant billing, and the data stores' internal design. Assume other teams own those.

What to produce. A high-level architecture covering: how tenant identity is authenticated and resolved on every request, how requests are routed to the correct tenant data partition, how cross-tenant access is structurally prevented (not just checked), how per-tenant resource limits contain a noisy neighbor, how large and small tenants share the fleet efficiently (including whether the biggest tenants get dedicated capacity), and how tenants are onboarded/offboarded live. Sketch the components and flow; we will probe specifics in checkpoints.