One deployment serving many customers whose data must remain separated.
The isolation decision is effectively irreversible. Even in a single-tenant pilot, carrying a tenant identifier costs almost nothing while retrofitting it touches every table, index, query and test.