Secure Multitenant AI Interfaces

The problem

One website, one AI interface, but many tenants behind it, each with its own sensitive data. The backend was a proprietary agentic system: the agent holds context, calls tools, and reaches for data on its own, so every one of those paths is a place one tenant’s information could surface in another tenant’s session. On top of that, tenant data was confidential enough that the backend couldn’t be trusted to hold onto it at all — it had to be an intermediate step, not a store.

What I built

The architecture for keeping tenants isolated end to end, plus the provisioning that enforces it. The design goal was isolation by construction rather than by filtering after the fact — each tenant’s agent gets its own bounded context and its own reach, so cross-tenant access isn’t something the system has to be trusted to check. The backend itself was built to be stateless with respect to tenant data: information flowed through just far enough to render on the frontend and was never persisted.

What I took from it

Security work on an agentic system is mostly about narrowing what the agent can reach, not about reviewing what it says. The tool surface is the boundary, so that’s where the design effort goes — and when the data itself is sensitive enough, the safest place to hold it is nowhere at all.