Design tenant isolation across retrieval, tools and caches

A tenant column in the main database is not tenant isolation. An AI workflow may copy content into an index, call tools with separate credentials, cache an answer and emit a trace. If one of those layers drops the tenant context, a later filter cannot repair the exposure.

Build the decision artifact

Derive tenant identity from an authenticated principal, never from an untrusted prompt parameter. Bind that identity to document filters, tool scopes, queue partitions, cache keys, storage prefixes and telemetry access. Decide whether isolation is logical or physical at each layer, based on consequence and operational cost. Deny when the tenant cannot be established.

The enterprise delivery lab makes this reasoning executable with synthetic data:

from enterprise_cases import tenant_isolation_case

result = tenant_isolation_case()
assert result["allowed"] is True
assert result["cross_tenant_attack_allowed"] is False
assert result["request"]["cache_key"].startswith("north:")
assert result["synthetic"] is True

The fixture accepts a consistent north-tenant request and rejects a document identifier carrying the south prefix. It also makes the cache key principal-aware. That is a compact contract test; production evidence would include policy-engine decisions, index configuration, credential scopes and negative tests at every boundary.

Test the failure path

Teams often test that tenant A can read tenant A and forget to prove that tenant A cannot read tenant B. Build adversarial cases for forged metadata, stale cache entries, tool identifiers, shared batch jobs and privileged support views. Redact sensitive payloads without removing the tenant and correlation fields needed to investigate.

Save evidence that another reviewer can inspect:

• layer-by-layer isolation matrix
• negative tests for cross-tenant retrieval and tools
• cache-key and invalidation specification
• telemetry access policy and sampled trace

This exercise aligns with the enterprise delivery, secure integration, operations and leadership work in the FDE for Professionals course. The course link describes the pathway; this local draft and its synthetic verifier do not claim that a client deployment, security approval or production result occurred.

Practice task

Trace a single tenant identifier through eight components. Write a negative test wherever the identifier is transformed, copied or inferred.

Continue learning

This article is part of the Enterprise AI delivery and architecture sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Map an enterprise data boundary before building retrieval.
• Continue with Enforce document authorization before semantic retrieval.

Reference: OWASP: vector and embedding weaknesses.