« Phase 13 README · Warmup · Deep Dive · Principal Deep Dive · Core Contributor · Staff Notes

Phase 13 — Hitchhiker's Guide

30-second mental model

Many customers, shared infra, one rule: isolation. Derive tenant_id from the verified token, never the request body, and thread it through every data access — rows, vector namespaces, prompt cache, agent memory, secrets. RBAC is default-deny. Quotas are per-tenant (token bucket). The #1 AI leak is a shared vector index. Audit everything (metadata, not secrets).

The facts to tattoo on your arm

FactWhy
tenant_id from the token, not the bodytrusting the request = privilege escalation
RBAC default-denyfail closed, not open
shared vector index = #1 leakscope by namespace or tenants read each other
prompt cache + agent memory leak tookey them by tenant
per-tenant secrets / BYOKnever cross-tenant, never logged
token bucket per tenantnoisy-neighbor isolation
audit = metadata, append-onlyincident response + compliance

Framework one-liners

  • OAuth2 / OIDC + JWT — the real auth; short-lived, signed, rotated.
  • Postgres row-level security (RLS) — DB-enforced tenant scoping.
  • Pinecone / pgvector namespaces — per-tenant vector isolation.
  • silo / pool / bridge — the multi-tenant SaaS isolation models (dedicated / shared / hybrid).
  • Vault / KMS + BYOK — per-tenant secret custody.

War stories

  • The shared-index leak. Retrieval wasn't scoped; one customer's agent surfaced another's docs. The classic AI multi-tenant breach.
  • The trusted request body. An endpoint read tenant_id from JSON; an attacker changed it and read another tenant. Always derive it from the signed token.
  • The noisy neighbor. One tenant's batch job ate the shared LLM rate limit; everyone else timed out. Per-tenant quotas fix it.

Vocabulary

tenant isolation · authN vs authZ · JWT / OAuth / OIDC · RBAC / ABAC · row-level security · vector namespace · silo/pool/bridge · token bucket / quota · BYOK · audit log.

Beginner mistakes

  1. Trusting tenant_id from the request instead of the token.
  2. A shared vector index / prompt cache / agent memory with no tenant key.
  3. RBAC that fails open (no default-deny).
  4. No per-tenant quotas (noisy neighbor).
  5. Logging secrets in the audit trail.
  6. Bolting isolation on after instead of threading tenant_id through every layer.