01 / The operating case
What changes in a real workflow?
A support agent for tenant A passes a tenant B customer ID to a shared MCP server.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Bind tenant to principal and task, propagate a verified tenant claim, include tenant predicate in every data query and reject argument overrides.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
An object ID alone is treated as sufficient access to another tenant’s record.
Evidence to retain
Record authenticated tenant, target tenant, query predicate, denial and data-return status.
04 / Canonical scope
Why this reference stands alone
MCP cross-tenant isolation focuses one server; this guide owns end-to-end implementation.
Illustrative implementation artifact
Tenant binding invariant
trustedTenant = authenticatedPrincipal.tenant
reject if task.tenant != trustedTenant
resource = lookup(tenant=trustedTenant, id=request.objectId)
reject if resource missing
// downstream query includes trustedTenant predicatePrimary references