Abstract
Research question
How should tenant identity cross retrieval and action boundaries without becoming prompt text?
Context
Tenant names in user text are ambiguous and forgeable. Multi-tenant AI features need the same resolved identity and authorization context as ordinary application features.
Proposed approach
- Authenticate and resolve membership before invoking AI orchestration.
- Carry a trusted tenant key separately from conversational text.
- Reapply tenant filters at retrieval and action execution.
Implementation
- Tenant-aware request context in a reference application
- Filtered retrieval with source ownership visible in results
- Tests for cross-tenant query behavior
Observations
- 01
Prompt content is useful for intent but unsuitable as the tenant authority.
- 02
Source metadata makes boundary failures easier to observe during development.
Limitations
This work reports an implementation-linked investigation. It is not a
peer-reviewed paper, certification or customer case study.
- The prototype does not replace application authorization testing.
- The current public demo uses a simplified identity switcher.
Reproduce or inspect
Revision note and next questions
Last revised 2026-07-25 against AI Fabric 0.4.0 and the linked public artifacts.
- How should tenant context be signed across service boundaries?
- What audit evidence is required for shared vector backends?
