Test tenant isolation in a retrieval tool

An agent may invent or receive a valid document ID from another tenant. The retrieval service must enforce identity scope before reading or returning content.

Deny a cross-tenant identifier

The MCP contract lab uses two synthetic tenants.

from mcp_cases import tenant_isolation_case

result = tenant_isolation_case()
assert result["allowed_indices"] == [0]
assert result["denied_before_read"] is True
assert result["cross_tenant_content_returned"] is False
print(result["results"])

T-1 can read T1-D1 and cannot read T2-D1. This is dictionary membership, not a database row-level-security test.

Enforce scope at the data layer

Derive tenant/user from validated credentials, never tool arguments alone. Include tenant in keys, filters, cache namespaces and audit events. Prefer database/search policies that enforce it below model/application selection.

Return a safe denial that does not reveal whether another tenant’s ID exists. Recheck every page and tool call. Keep service credentials from bypassing user scope.

Test negative paths

Try guessed IDs, copied cursors, cache keys, batch arrays, embeddings and logs. Include concurrent requests and changed membership. Verify prohibited content never reaches prompt context or tracing.

The Generative & Agentic AI course connects tenant isolation to MCP identity, retrieval metadata and audits.

Exercise

Build two-tenant retrieval over local records and 30 cross-tenant tests. Add a shared cache intentionally, demonstrate the leak, then fix namespace and policy.

Continue learning

This article is part of the MCP and integration contracts sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Keep secrets out of tool descriptions and logs.
• Continue with Design an approval-required write tool.

Reference: OWASP authorization testing.