Rule number 1 of multitenancy: never assume all tenants are good actors.
Your design must always assume that some tenants will try to abuse the platform. Even when a tenant misbehaves, the system should continue to operate. The load of one must never impact others.