Who Decides the Tenant? A Small Rust Guard for AI Tool Calls
I have been thinking about a fairly ordinary failure mode in AI-enabled SaaS products. A support agent is helping a user from tenant-a . The user asks about a contract, and the model produces a perfectly valid tool call: get_contract("contract-b") There is nothing obviously wrong with the call. The tool exists and the argument has the right shape. The problem is that contract-b belongs to…
I examined a common failure mode in AI-enabled SaaS products. A support agent was assisting a user from tenant-a. The user requested a contract, and the model generated a valid tool call: get_contract(contract-b). The issue arose because contract-b belonged to tenant-b. While the call seemed legitimate, the problem lay in the fact that the resource was not owned by the tenant making the request.
To address this, I created the TenantInvariant Rust crate, an experimental library aimed at making tenant isolation an executable invariant in AI agent tool calls. This library ensures that tenant isolation is checked before an AI agent's tool call executes, preventing unauthorized access to resources from other tenants.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
