Some products are a workflow with a chart on the end. Others are the chart. If yours is the second kind, the interesting problem is not drawing them: it is defining a measure once, keeping it fast, and being certain that one customer's dashboard can never show another customer's rows.
The semantic layer is drizzle-cube, which is a separate open source project, wired in and scoped here.
Active users, revenue, whatever your domain calls its numbers: written down in one place as a measure over your own tables, then used by every chart, every filter and every export. The second definition is where reporting systems start disagreeing with themselves.
A template is a typed object in the repository. Each organisation gets its own copy on creation, and can edit it without touching yours. Add a template later and existing customers pick it up.
The expensive aggregates are pre-built per organisation by an hourly job rather than computed on every page load. There is a freshness check, so stale is something you can see rather than something a customer reports.
The scoping lives inside each cube, not in the page that renders it. A test runs every cube as two different organisations and fails if either can see the other, and a new cube without a case in that test fails the build.
The same layer is exposed as a query endpoint, so a customer with an analyst can ask something you never built a chart for, still scoped to their own rows.
The same cubes, the same scoping, in the shape an MCP client expects. Not a second implementation, which is the only reason it is safe to have at all.
The layer itself is drizzle-cube, open source and usable on its own. What the kit adds is the scoping, the per organisation dashboards and the test that keeps both honest.
A dashboard, an ad hoc query, and an endpoint an AI client can use. All three run the same cubes with the same customer filter.
This is the part that is hard to retrofit. If charts are built page by page, the ad hoc query is a second implementation with its own idea of what a measure means and its own chance of forgetting the filter. Defining the measure once is what makes the other two free and safe.
Read the analytics concept
The demo organisation has a populated overview built from the same pieces you would use. Open it and then open the template it was copied from.
A measure, a dimension, and the filter that ties it to the organisation. That filter is the whole safety story, and it is one line.
The test compares its own list of cases against the list of cubes, so this is not optional. That is deliberate.
Add the chart to a dashboard template, and every organisation gets it. Existing ones pick it up without a migration.