01 / The operating case
What changes in a real workflow?
A support agent for tenant A passes a customer ID that also exists in tenant B, and a shared tool queries by ID alone.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Derive tenant from authenticated context, include it in the resource key and downstream query, and deny a mismatch before returning data.
03 / Failure and evidence
What goes wrong, and what can be proven?
Tenant ID is accepted from an untrusted tool argument or lost after a queue handoff.
Retain authenticated tenant, requested target, downstream tenant predicate and denied mismatch.
04 / Canonical scope
Why this reference stands alone
Server isolation covers workload compromise; this page owns per-tenant authorization within a shared server.
Protocol or attack trace
Tenant predicate test
Authenticated caller belongs to tenant A and passes tenant B object ID to shared MCP search.
Resolve tenant from authenticated context and force tenant=A in downstream query; return no B data.
Primary references