Who Decides the Tenant? A Small Rust Guard for AI Tool Calls

Описание и применение

Кратко о том, как библиотека TenantInvariant защищает SaaS‑приложения от кросс‑тенантных вызовов инструментов, проверяя владельца ресурса на сервере.

Задача

AI agents can propose resource IDs that belong to another tenant, leading to cross‑tenant data access.

Результат

TenantInvariant prevents cross‑tenant tool calls by validating ownership server‑side, reducing the risk of data leakage in AI‑enabled SaaS.

Рабочий процесс

• 1. User prompts AI agent. 2. Model selects a tool and proposes a resource ID. 3. Server resolves the real owner of the proposed resource from a trusted source. 4. TenantInvariant compares the authenticated actor’s tenant with the resolved owner. 5. If they match, the tool call proceeds; otherwise it is denied and an error is logged.
• 6. Normal authorization and tenant‑scoped data operations continue for allowed calls.

Доказательства

TenantInvariant compares actor and owner before executing the tool

Источник

The first tests were the obvious ones: a resource in the same tenant is allowed, a resource in another tenant is denied, and an unknown owner is denied.

Источник