Tenant isolation and verified identity in AgentPlat

Derive tenant context from verified identity

The tenancy reference places organization models, identity and authorization with the application. AgentPlat does not issue shared tenant keys or operate a tenant-management service.

At an application boundary, verify the session or credential and resolve the organization it represents. Do not accept a decoded but unverified token payload as proof of membership. A string that names a tenant is an identifier, not evidence that the caller belongs to it.

Bind the actor as well as the organization

Two people in one organization may have different rights. A reviewer may approve one kind of work while another participant can only contribute evidence. Identity handling must therefore consider both tenant and actor.

The integration controls guide describes the injected authenticator and calls for application authorization around actor fields, decisions, participant creation and permissions. Verify the exact route behavior for the coordinated package version rather than generalizing one protected field to every operation.

Check scope at each exposed transport

An HTTP client, background integration and MCP client may reach the same Room services. Each route into the application needs a trustworthy principal and the appropriate authorization boundary.

For an illustrative support workspace, a browser user may read a case Room while an automation can submit a draft only to a specific queue. The automation's technical ability to send requests should not make it equivalent to a human reviewer. Preserve the principal used for the actual operation in retained evidence.

Use negative tests with known resources

• Request a known Room under another tenant's valid identity.
• Attempt a transition using a different participant's identifier.
• Submit a tenant field in a body that conflicts with verified context.
• Repeat with an expired or missing credential.
• Check optional operational routes as well as Room reads.

The HTTP API contract documents authenticated context and reserved fields. These suggested tests verify how the complete host applies that contract, including the application logic around it.

Keep diagnostic evidence scoped

A rejected request still creates operational information. Retain enough to explain the denial without copying another tenant's sensitive payload into a response or broadly accessible log.

Use the audit guidance when deciding which actor, scope and policy references to keep. A useful isolation test examines both the denied action and what the denial itself discloses.