Many Customers, One Agent

Priya asks Juno about order B forty two. That's Sam's order. If Juno reads it out, that's a data breach. The model doesn't know who owns what, and you can't ask it to remember. So who's logged in has to be enforced somewhere that the model can't touch.

• Priya asks about Sam's order
• That's a data breach
• Enforce it where the model can't reach

Identity outside the model

Look at the tool. It takes a user argument, which is set by the session, and the model never gets to see that. The model only supplies the order number. Inside, the tool checks who owns the order. Run it. Priya can see her own order. When she asks for Sam's, she gets, no such order, as if it didn't exist. Nothing that a customer types can change the user, because it never goes through the model. Never let the model pass the user ID, or an attacker will simply ask it to.

ORDERS = {"A17": {"owner": "priya", "price": 640}, "B42": {"owner": "sam", "price": 28}}

def get_order(order_id, *, user):
    order = ORDERS.get(order_id)
    if order is None or order["owner"] != user:
        return {"error": "No such order"}
    return order

class Session:
    def __init__(self, user):
        self.user = user

    def call(self, tool, **args):
        return tool(**args, user=self.user)

priya = Session("priya")
print(priya.call(get_order, order_id="A17"))
print(priya.call(get_order, order_id="B42"))

{'owner': 'priya', 'price': 640}
{'error': 'No such order'}

Isolation checklist

For every shared agent, check these. Tools get the user from the session, never from the model. Memory stores are separated by user. Search filters by account, before the model sees any results. Logs are protected too. And caches don't mix users, because a shared answer can leak someone's data. Test this directly, by logging in as one user, and asking for another's data.

Summary