Part 3 of 4 · 2 min read
Exercises
Easy
Easy 1: Run it (30 minutes)
Run python -m pytest -q and python run_all.py in code/mini-tenancy.
Done when: you report the leaks with and without each control.
Easy 2: Map your data (30 minutes)
List every store, cache and log that holds customer data in an agent you know.
Done when: each has an isolation control and an erasure entry.
Easy 3: Find the argument (30 minutes)
List your agent's tools and mark any that take a tenant, user or account id from the model.
Done when: you change each to read it from the session.
Hint
the context should be created at the edge and passed down, not rebuilt from arguments.
Medium
Medium 1: Row-level security (4 hours)
Add Postgres row-level security to a table and set the tenant per connection.
Done when: a query without a tenant returns no rows and a cross-tenant read fails.
Hint
SET app.tenant = ... per connection and a policy comparing it with the row's tenant column.
Medium 2: Per-tenant retrieval (4 hours)
Compare namespaces, metadata pre-filter and post-filter on a real vector store.
Done when: you report recall and latency by tenant size.
Hint
check the vector store's filter semantics: pre-filter versus post-filter varies by engine and index type.
Medium 3: Quotas (3 hours)
Add per-tenant token and concurrency quotas to the queue worker (module 2).
Done when: a flooding tenant does not change another tenant's p95 latency.
Hard
Hard 1: Cross-tenant test suite (8 hours)
Build the automated attack suite from section 7. (I did not run this, so your numbers are the ground truth.)
Done when: it runs in CI and fails when you reintroduce an unscoped query.
Hint
include tests with injected instructions in retrieved documents.
Hard 2: Offboarding drill (6 hours)
Delete a test tenant everywhere and verify. (I did not run this.)
Done when: a scan finds no tenant data and the audit log records each store.
Hard 3: Per-tenant keys (8 hours)
Encrypt tenant data with per-tenant keys and implement key deletion as erasure. (I did not run this.)
Done when: data becomes unreadable after key deletion, including in backups.