Tenant Isolation for AI Agents

Definition

Tenant isolation ensures that a shared application keeps each customer’s data and operations within the authorized tenant boundary. An agent workflow must preserve that boundary throughout planning, retrieval, delegation and execution.

An agent can move information through more places than a conventional single-request application. A document may become an embedding, a summary, a cached answer or a child agent’s memory. Every derived form needs an explicit decision about who can retrieve it and for what purpose.

What it covers

Request context

Derive the tenant from authenticated, verified context.

Storage

Apply boundaries to documents, embeddings, summaries and memory.

Execution

Carry validated context into queues and delegated work.

Reuse

Scope caches and shared intermediate artifacts correctly.

The tenant boundary and the individual user’s permissions are different dimensions. Two people in the same company may not have equal access to personnel or financial records. Keep both checks in the design rather than treating tenant membership as permission for every document within that tenant.

In practice

Practical design patterns by Min.

• Identify every store and service that holds tenant-derived information.
• Apply resource authorization before retrieval or cache delivery.
• Test two tenants with overlapping local identifiers and similar requests.
• Clear or partition conversation and tool state when the tenant context changes.

Trace a representative request through the database, retrieval index, task queue and export service. Confirm that each component receives trusted context. For background jobs, decide whether authorization must be revalidated when the job runs and what should happen if the requester has lost access since submission.

Research notes

Source-grounded details and editorial applications. Follow each link for the original document.

Working example

Why the controls matter

The billing example can leak information without any new database query if the cached answer is delivered under the wrong key. Citations, snippets and conversation history also matter. Test the whole response, including hidden metadata later used to continue the conversation.

Common pitfalls

• Accepting a tenant identifier chosen by the model or supplied unchecked by the client.
• Filtering the first document query while leaving derived summaries shared.
• Assuming separate display names imply separate data access.

Stronger isolation may require separate infrastructure for some workloads, while others can use carefully enforced logical boundaries. Document the choice and its evidence. An architecture diagram alone cannot establish that a queue worker or retrieval filter actually rejects mismatched context.

Questions for operational review

Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.

• Which derived artifacts contain tenant information?
• Can a queued job continue after its authority changes?
• Do isolation tests cover caches, citations and memory as well as source records?