Who Decides the Tenant? A Small Rust Guard for AI Tool Calls

Description and use

A concise overview of how the TenantInvariant Rust crate safeguards AI‑enabled SaaS from cross‑tenant tool calls by validating resource ownership server‑side.

Problem

AI agents can propose resource IDs that belong to another tenant, leading to cross‑tenant data access.

Outcome

TenantInvariant prevents cross‑tenant tool calls by validating ownership server‑side, reducing the risk of data leakage in AI‑enabled SaaS.

Workflow

• 1. User prompts AI agent. 2. Model selects a tool and proposes a resource ID. 3. Server resolves the real owner of the proposed resource from a trusted source. 4. TenantInvariant compares the authenticated actor’s tenant with the resolved owner. 5. If they match, the tool call proceeds; otherwise it is denied and an error is logged.
• 6. Normal authorization and tenant‑scoped data operations continue for allowed calls.

Evidence

TenantInvariant compares actor and owner before executing the tool

Source

The first tests were the obvious ones: a resource in the same tenant is allowed, a resource in another tenant is denied, and an unknown owner is denied.

Source