When would you choose isolated cache over shared cache for a multitenant entity?

EclipseLink's @Cache annotation supports an isolation setting with three levels: SHARED (the default, one cache entry visible to every EntityManager from the factory), PROTECTED (shared at the reference/relationship level but isolated per-tenant for the entity's own data), and ISOLATED (entirely per-EntityManager, never shared).

For a multitenant entity holding tenant-specific business data, like an Invoice or Account, SHARED caching is actively dangerous: it risks one tenant's cached row being returned to a query executed under a different tenant's context, a serious data-isolation bug rather than just a performance quirk. ISOLATED caching avoids that entirely at the cost of losing cross-request cache reuse for that entity, since every EntityManager rebuilds its own view from scratch.

PROTECTED is the common middle ground for reference/lookup data referenced by multitenant entities, like a shared Country or Currency lookup table: that data is safe to share across tenants (it's identical for everyone), while the actual tenant-owned entities pointing to it stay isolated per tenant context.