Multi-Tenant AI Data Isolation

Architecture

An end-to-end isolation architecture spanning identity, retrieval, caches, tools, prompts, traces, evaluations, exports, and deletion.

The architecture separates intent, policy, state, execution, evidence, and response. Each boundary has one accountable owner and an observable contract. Probabilistic components may propose or classify; deterministic software owns permissions, budgets, state transitions, and release conditions.

Decisions

| Decision | Required evidence | Review trigger | |---|---|---| | Bind tenant identity on the server and propagate it through every derivative. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change | | Namespace or partition retrieval and caches by policy context. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change | | Use tenant-scoped credentials and telemetry access. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change | | Make deletion follow lineage into indexes, caches, tests, and backups. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change |

Alternatives and trade-offs

A centralized control plane simplifies policy and evidence collection but can become a latency and availability dependency. Distributed enforcement reduces central bottlenecks but requires consistent identity, versions, and audit semantics. Prefer the smallest boundary that can enforce the invariant and prove the outcome.

Failure modes

• Client tenant IDs are trusted.
• Semantic caches omit tenant and policy versions.
• Global vector namespaces leak metadata or content.
• Evaluation datasets silently combine tenants.

Operational checklist

• [ ] Negative cross-tenant tests cover every storage and cache layer.
• [ ] Administrative access is audited and time-bounded.
• [ ] Provider calls receive only minimized tenant data.
• [ ] Exports enforce the same policy as interactive access.
• [ ] Deletion produces evidence without retaining deleted content.

Connected practice

• Labs: /labs/rag-pipeline-visualizer, /labs/prompt-injection-threat-model
• Projects: /projects/production-rag-blueprint, /projects/governed-agent-reliability

Sources

• nist-zero-trust
• nist-privacy-framework
• openai-data-controls
• w3c-prov-overview