The application—not the AI model—decides which tenant’s data a tool call can access. Derive tenant scope from verified identity and server-held session context, then check the requested capability and resource immediately before the tool accesses data or causes side effects. If identity, scope, or policy cannot be established, deny the call.
What the model may decide—and what it must not
An AI agent can choose an operation and supply its arguments: for example, it may request read_invoice(invoice_id). The application must resolve the applicable tenant from trusted authentication and session context, then decide whether that principal may read that invoice within that scope.
As an Amazon Associate I earn from qualifying purchases.
Do not make tenant_id a model-controlled tool argument. A later check of a model-supplied tenant value still gives the model a route to steer the requested scope. Removing that selector from the tool schema closes that particular route; it does not, by itself, establish that every other scope-integrity assumption is sound.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhere the authorization boundary belongs
Construct a request context in trusted authentication middleware and pass it to a guard and the operation. The guard checks the capability and resource against the verified principal, server-held tenant scope, and applicable policy. Invoke the operation only after an allow decision.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
verified principal + server-held tenant scope → authorization guard(tool, resource) → operation
Place the check immediately before protected data access or other side effects. A denial should happen before network I/O when the policy does not allow the call. Treat missing identity, invalid scope, and policy errors as denials rather than falling back to a default tenant or proceeding without a check.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This is a conceptual design sketch, not tested Rust code. The exact context types, policy rules, and resource lookup depend on the application. The important boundary is that trusted infrastructure supplies scope and the operation cannot run until authorization succeeds.
What the evidence does—and does not—show
A September 13, 2026 preprint by Baig, Gillani, Ali, and Siddiqui, The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents, reports a 373-trial ablation across eight model configurations and two transports. In the tested configuration, a correctly validated tenant parameter served all 26 out-of-scope attempts, including 26 of 41 plausible-pretext trials overall. When the tenant parameter was removed, no tool signature could express that read, but writable-scope forgery occurred in 12 of 56 trials.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
These are outcomes from that study’s setup, not universal rates or proof that any particular guard is secure. The evaluation used a Python FastMCP implementation and particular SQL engines; it is not a performance evaluation of Rust guard code. The authors explicitly caution: “It is not a machine-checked proof: we have no formal model of the system, no mechanized refinement from specification to code, and consequently no guarantee that the implementation realizes the invariants everywhere.”
How to apply the pattern in Rust and MCP
Keep trusted context separate from tool arguments
Represent authenticated identity and tenant scope in application-controlled request context. Make tool inputs describe the requested operation and resource, not which tenant the model wants to access. Validate that the principal may perform that operation on that resource under the context’s scope.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Guard every path to protected data
A small guard helps only if every relevant call path reaches it. Check direct tool handlers, delegated calls, background work, and database access for routes that bypass the authorization decision. Preserve the verified context across asynchronous work and connection boundaries; do not silently reconstruct scope from untrusted arguments or writable state.
Use tool filtering as a supplementary control
MCP tool discovery can reduce which capabilities a session sees, but visibility is not authorization. The tower-mcp documentation describes filtering tools, resources, and prompts based on session state, including a write guard that exposes write tools only when a session predicate succeeds. The ADK-Rust documentation says its manager does not grant tool approval; the application must apply its own authorization and approval policy.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
MCP is a protocol context, not a requirement for this boundary. The official Rust SDK, rmcp, supports building MCP servers that expose tools and clients that connect to them. The same separation of model request and application authorization applies to other tool-call architectures.
Choose a guard location that can deny before work
The af_mcp_client crate describes itself as a “Fail-closed MCP client over Streamable HTTP” and says its product authorization is evaluated before any network I/O. That is one concrete placement choice, not a universal mandate: whichever layer owns the check must be on every route to the protected operation and able to reject the call before its work begins.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to test before relying on the boundary
- Missing or invalid context: calls with absent identity, invalid tenant scope, or unavailable policy are denied.
- Cross-tenant resource requests: a principal cannot read or modify a resource outside its authorized scope, including when the model supplies plausible arguments.
- Pre-operation denial: rejected calls produce no protected data access, network request, or other side effect.
- Bypass coverage: each tool, delegated operation, and database path to protected data passes through the guard.
- Scope continuity: asynchronous tasks and downstream calls retain trusted context rather than accepting model-writable scope.
- Audit usefulness: logs can show which verified principal, capability, resource, and policy decision were involved without treating model-supplied tenant values as proof of identity.
Rust does not itself provide tenant isolation. The security claim rests on trusted inputs, complete call-path coverage, persistence-layer behavior, and fail-closed handling. Test those properties in the application rather than treating the existence of a guard function as proof.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
