Why the control plane never reads a tenant's database

A control plane that could read every brand's database directly would be convenient, and it would also make every brand depend on it. Lummet takes the opposite approach.

Two databases, two jobs

The control plane has its own database. It holds metadata: which brands exist, where they live, whether they are healthy, which staff can act on them. Each brand has a separate database holding its own content and users.

One narrow doorway

When the control plane needs something from a brand, it makes a signed HTTPS request to that brand's own API. The brand decides what that API exposes. If a brand does not support a resource, the dashboard says so instead of guessing.

What this buys

• A brand can be redeployed or migrated without touching the control plane.
• Removing a brand from the registry deletes only the registry entry.
• A fault in one brand cannot corrupt another, because they share no database.