Privacy, Logging, and Tenant Isolation as System Contracts