How much should a tenant be allowed to customize? Full open theming — any color, any font, any spacing — was the obvious first instinct, since it's the most flexible. Tested against real school brand colors, it broke down fast: several produced text-on-background contrast that failed AA, and free typography and spacing choices made the product feel inconsistent from screen to screen — which matters more than it sounds for a platform parents trust with their kids' schedules and payments.
Rather than trusting each tenant's taste, I split the system into what's owned by the brand and what's owned by the product. Tenants control exactly two things: a primary color and a logo. Everything else — backgrounds, text color, spacing, typography — is locked.
The primary color isn't dropped in raw, either. It feeds an automatic derivation system that expands it into a full accessible palette — hover and active states, status colors, a neutral scale, 30+ tokens in total — and detects whether the brand color reads warm or cool to set the right supporting palette around it. A school gets a product that visibly feels like theirs, without ever being able to accidentally ship something illegible or off-brand.
Every tenant gets bespoke branding; every tenant is contrast-compliant by construction, not by review. Onboarding a new school's brand took one color value instead of a design pass — the system does the design work that would otherwise fall on me for every new customer.