Part 1 of 4 · 1 min read
Overview
A cross-tenant leak is a security incident and often a legal one (Level 10 module 10). Agents add new leak paths: model-chosen arguments, shared memory, shared caches and retrieval. The project criteria for this level ("a deployed agent service") are not complete without a statement of how tenants are isolated.
About the example, and what is real
Real: the scoped repository, namespace versus post-filter retrieval, tenant-keyed cache, session-bound identity, quota simulation, offboarding registry and the 17 test cases in code/mini-tenancy. Assumed: 5 percent forgetting rate, model obedience of 30 percent, tenant size distribution (Zipf), random 16-dimensional vectors, top-k of 5, the quota model (flood of 400 tokens per second against a 100 per second budget). Not real: no real database, row-level security, vector store, authentication or deployment; no real prompt injection.