01 / Attack path
How the boundary is crossed
A report agent for tenant A receives a tenant B object ID from a retrieved document and calls a shared data API.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Derive tenant from authenticated authority, bind it to the task and every resource lookup, and deny caller-supplied tenant overrides.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A globally unique object ID is mistaken for permission to access the object.
Keep authoritative tenant, requested object, query predicate, decision and data-return status.
04 / Canonical scope
Why this reference stands alone
MCP cross-tenant isolation focuses a shared MCP server; this threat applies across agent execution paths.
Protocol or attack trace
Tenant-context confusion
Document from tenant B supplies object ID to agent executing tenant A ticket.
Executor derives A from trusted task, adds tenant predicate to lookup and returns no B data.
Primary references