Context
A shared AI product can serve several organizations while processing information that belongs to each separately. A conversational request must therefore carry the same access boundary as an ordinary application request. Gilles implemented or technically led tenant and query controls for a production multitenant platform. The verified work included tenant-scoped data access, read-only SQL, query and tool validation, and execution limits. Those are concrete controls, without an absolute security guarantee.
Approach
The general approach starts with authenticated application context and enforces the permitted scope at the point where data is accessed. Generated instructions cannot be the authority for changing that scope. For agentive BI, this matters when an apparently harmless question triggers a data query. The same scope needs to survive tool execution and answer construction, so that a successful query cannot become an excuse to broaden the next request.
Quality controls
Read-only execution restricts changes but still requires controls on what can be read. Tool validation and limits constrain the work an agent can request. A sound general test strategy includes attempted cross-tenant reads, stale identities, reused results, and failure paths; this is guidance, not a published independent audit of the engagement. The article on agent permissions develops these questions. PII masking addresses unnecessary personal information and complements the access boundary.
Outcomes
The delivered result was production enforcement of tenant-scoped querying alongside validation and execution controls. The evidence supports those implemented capabilities. It does not establish that every possible information channel is secure or that future changes cannot weaken the boundary.
- Implemented or led tenant-scoped and read-only query controls.
- Added validation and execution limits around agent tool use.
