The compliance tier is a routing rule, not a code path

One customer signed a contract with a clause: every request against their data gets a body-level audit record with a retention period. Thirty-nine other customers signed nothing of the sort and don't want the latency.

Your app is one container, tenants as path prefixes. The hook is one rule on the service: match: { path: "/t/acme/*" }, script /acme-audit. Rules evaluate first-match-wins, and a request that matches no rule isn't dispatched at all: it goes straight to the upstream as before. So /t/acme/… passes through your hoody-exec, gets its record, and is forwarded; /t/globex/… never meets the hook.

When a second customer signs the same clause, it's a second rule, moved into place with PATCH …/position. The app code contains no if (tenant === 'acme').