Two workspaces, one username. Who gets it?

Otto had a quiet sign-in problem: usernames were unique across the whole install. A second workspace couldn't reuse a name another workspace had taken, and the "already taken" message told that manager the name existed somewhere else. Two side paths could also reach the wrong person.

I weighed three options: → email + password → keep global names → workspace + username

I chose workspace + username. What that meant in practice: → A real unique index per workspace holds the rule, not a trigger counting rows → The Workspace field is prefilled from the sign-in link or your last sign-in on that device, so nobody has to type it → Old apps keep working until the first name clash, then sign-in is refused rather than guessed → The error says "Incorrect workspace, username or password." and gives no hint which was wrong → Failed sign-ins are counted per workspace and username, so guessing at one account can't lock out another

PM lesson: keeping global names looked like the cheapest option, but it was the one leaking that a name existed elsewhere.

How do you handle logins across tenants?