Test cross-tenant cache isolation

A response cache can bypass controls that retrieval and tools enforce correctly. Semantic similarity makes this worse: two tenants may ask equivalent questions while having different permitted evidence.

Define the measurable control

Build the key from tenant, effective principal or authorization version, normalized request, model/prompt version and relevant data version. Partition storage where the consequence warrants it. Validate permissions again on read, expire entries after revocation and avoid shared semantic caches for sensitive content.

The AI reliability lab makes the decision reproducible with authored data:

from reliability_cases import cache_isolation_case

result = cache_isolation_case()
assert result["same_tenant_hit"] == "north-result"
assert result["cross_tenant_hit"] is None
assert result["anonymous_hit"] is None
assert result["shared_semantic_cache"] is False

The north tenant receives its stored value. The same user and question under south, or without a tenant, miss. The fixture disables shared semantic caching. A real implementation also tests group changes, deleted documents and support-operator impersonation.

Challenge the result

Hashing sensitive text does not remove isolation requirements because identical hashes can still reveal existence. Cache metrics and debug tooling can leak keys or payloads too. Redact observability while preserving tenant and version fields for investigation.

Keep a reviewable evidence pack:

• cache-key and partition specification
• positive and negative tenant tests
• revocation and invalidation test
• telemetry redaction review

This work aligns with the evaluation, security, cloud operations, reliability and FinOps sequence in the FDE for Professionals course. The linked course describes the learning pathway; this article’s numbers are synthetic and do not report a model, client, audit or production result.

Practice task

Write four keys for the same question under two tenants and two authorization versions. Prove exactly which pair may share an entry.

Continue learning

This article is part of the Advanced AI reliability and assurance sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Design a production evaluation sampling strategy.
• Continue with Threat-model tool misuse and data exfiltration paths.

Reference: OWASP: Vector and Embedding Weaknesses.