I don’t know of such a guide, but the argument would not be for separate databases, running on a separate machine/vm, but just a logical separation in named databases, which could be running on the same machine/vm and database server process. And, in the case they’re using PostgreSQL or Oracle, they could also have the Keycloak and application databases running in separate schemas to enforce further isolation. The only argument (good) argument I can think of for running on a separate machine/vm is for resource contention, in the case they’re really slamming their application database.