Tenant Isolation for AI (L134 payoff)

The tenant isolation for AI is the L134 discipline applied to the prompts, the caches, and the vector stores (L320) — the surfaces (the prompts L312, the caches L269, the vector stores L183, L320), the boundary (the tenant ID everywhere: the prompt's context L320, the cache's key L320, the vector's metadata L180, L320), and the enforcement (the row-level security L134, the prefix scoping L265, and the retrieval's filters L189, L320) — the L134 discipline (L134), AI-shaped (L320).

The one-sentence interview answer: "The tenant isolation is the L134 discipline, AI-shaped (L320). The surfaces (L320): the prompts (L312) — the tenant's context (L320) in the prompt (L320); the caches (L269) — the tenant's responses (L171) in the Redis (L243); the vector stores (L183) — the tenant's chunks (L316) in the index (L183); and the knowledge bases (L280) — the tenant's documents (L316). The boundary (L320): the tenant ID everywhere (L320) — the prompt's tenant (L320), the cache's key (L320), the vector's metadata (L180) — the L134 discipline (L134): the tenant (L320) scopes every read and write (L320). The leaks (L320): the cross-tenant retrieval (L189) — the filter (L180) missing; the shared cache (L269) — the key (L320) missing; the shared knowledge base (L280) — the poison (L316) crossing (L320). The enforcement (L320): the row-level security (L134) on the RDS (L268), the prefix scoping (L265) on the S3 (L265), and the retrieval's filters (L189) on the vectors (L183). The AI shape (L173): the multi-tenant AI SaaS (L357) — the isolation (L320) at every surface (L320) — the L134 payoff (L134), AI-shaped (L320)."

Think of the tenant isolation as the apartment building with the locked floors. The building (the AI SaaS, L357) has the apartments (the tenants, L320). The L134 rule (L134): every floor (the surface, L320) is locked per apartment (L320): the mail slots (the prompts, L312) — the tenant's letters (L320) only; the shared pantry (the caches, L269) — the tenant's shelves (L320) labeled; the archive (the vector store, L183) — the tenant's files (L320) filed separately. The leaks (L320): the open floor (L320) — the tenant A's file (L320) in the tenant B's hands (L320). The locks (the enforcement, L320): the keycard (the tenant ID, L320) required at every door (L320). The building works because every floor is locked, every shelf is labeled, and every door checks the card (L320).

   the building (the AI SaaS, L357)
   ┌────────────────────────────────────────────────────────┐
   │ the floors (the surfaces, L320) — the prompts (L312),  │
   │ the caches (L269), the vectors (L183)                  │
   │ the locks (the boundary, L320) — the tenant ID (L320)  │
   │ the leaks (L320) — the open floors (L320)              │
   │ the keycard (the enforcement, L320) — at every door    │
   └────────────────────────────────────────────────────────┘

The mental model is the building: the floors, the locks, and the keycard (L320).

   the tenant A's request (L320)
        │  the tenant ID: A (L320)
        ▼
   ┌────────────────────── THE PROMPT (L312) ───────────────────────────┐
   │  the context: the tenant A's docs only (L320)                     │
   │  the retrieval (L189): the filter tenant=A (L180, L320)           │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE CACHE (L269) ────────────────────────────┐
   │  the key: tenant:A:resp:{hash} (L320)                             │
   │  the tenant B's key (L320) → the miss (L320)                      │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE STORES (L320) ───────────────────────────┐
   │  the RDS (L268): the row-level security tenant=A (L134)           │
   │  the S3 (L265): the prefix tenant/A/ (L265, L320)                 │
   │  the vectors (L183): the metadata filter tenant=A (L180)          │
   └──────────────────────────────────────────────────────────────────┘

The flow is the boundary: prompt → cache → stores, the tenant ID everywhere (L320).

• The surfaces (L320). Where the tenant's data lives (L320): the prompts (L312), the caches (L269), the vector stores (L183), the knowledge bases (L280), the logs (L329).
• The boundary (L320). The tenant ID everywhere (L320): the prompt's context (L320), the cache's key (L320), the vector's metadata (L180), the log's record (L322).
• The leaks (L320). The cross-tenant paths (L320): the retrieval without the filter (L189), the cache without the key (L269), the knowledge base shared (L280).
• The enforcement (L320). The row-level security (L134) on the RDS (L268), the prefix scoping (L265) on the S3 (L265), the retrieval's filters (L189) on the vectors (L183).

• A multi-tenant AI SaaS (L357). The isolation (L320) at every surface (L320): the prompts (L312), the caches (L269), the vectors (L183).
• A RAG platform (L280). The per-tenant knowledge bases (L280) — the retrieval's filter (L189) and the metadata (L180).
• A chat product (L162). The per-tenant sessions (L237) — the cache's key (L269) with the tenant (L320).
• A regulated workload (L371). The isolation (L320) as the compliance (L371) — the tenant's data (L313) bounded (L320).
• Anything multi-tenant (L357). The L134 discipline (L134), AI-shaped (L320) — the tenant ID everywhere (L320).

The through-line: the boundary is the tenant's — the ID everywhere, the leaks closed (L320).

Say it in four moves:

1. The surfaces. "The prompts (L312), the caches (L269), the vectors (L183)."
2. The boundary. "The tenant ID everywhere (L320)."
3. The leaks. "The cross-tenant retrieval and the shared caches (L320)."
4. The enforcement. "The row-level, the prefixes, the filters (L320)."

• The tenant ID is the invariant (L320). The prompt (L320), the cache (L269), the vector (L183) — the tenant ID (L320) in every key and every filter (L320).
• The retrieval is the leak's door (L189). The vector search (L189) without the tenant filter (L180) — the cross-tenant results (L320) — the filter (L189) is the lock (L320).
• The cache is the leak's shelf (L269). The shared cache (L269) — the tenant A's response (L171) to the tenant B (L320) — the tenant key (L320) is the lock (L320).
• The knowledge base is the poison's bridge (L280). The shared base (L280) — the poisoned document (L316) crossing (L320) — the per-tenant bases (L320) are the lock (L320).
• The audit is the boundary's record (L322). The tenant's access (L320) — the L322 audit (L322) records the who and the what (L320).

• The shared vector store (L183). The index (L183) without the tenant filter (L180) — the cross-tenant retrieval (L189) — the metadata (L180) is the lock (L320).
• The shared cache (L269). The cache (L269) without the tenant key (L320) — the tenant A's data (L171) to the tenant B (L320).
• The shared knowledge base (L280). The one base (L280) for all (L320) — the per-tenant bases (L320) are the lock (L320).
• The prompt's context (L312). The tenant A's docs (L320) in the tenant B's prompt (L312) — the retrieval's filter (L189) is the lock (L320).
• The logs un-tagged (L322). The tenant's record (L322) without the tenant ID (L320) — the audit (L322) can't attribute (L320).

• Scope every surface (L320) — the tenant ID everywhere (L320).
• Filter the retrieval (L189) — the tenant's metadata (L180).
• Key the cache (L269) — the tenant's prefix (L320).
• Isolate the bases (L280) — the per-tenant knowledge (L320).
• Tag the logs (L322) — the tenant's audit (L320).

Q: Walk me through the tenant isolation for AI.

A: The L134 discipline, AI-shaped (L320). The surfaces — the prompts (L312), the caches (L269), the vectors (L183). The boundary — the tenant ID everywhere (L320). The leaks — the cross-tenant retrieval (L189) and the shared caches (L269). And the enforcement — the row-level (L134), the prefixes (L265), the filters (L189).

Q: Where does the AI data leak between tenants?

A: Three paths (L320): the retrieval (L189) — the vector search (L183) without the tenant filter (L180) returns the other tenant's chunks (L320); the cache (L269) — the shared Redis (L243) without the tenant key (L320) serves the other tenant's responses (L171); and the knowledge base (L280) — the shared base (L280) lets the poisoned document (L316) cross (L320).

Q: How do you enforce it?

A: The tenant ID at every surface (L320): the retrieval's filter (L189) on the metadata (L180); the cache's key (L269) with the tenant prefix (L320); the S3's prefixes (L265) per tenant (L320); and the row-level security (L134) on the RDS (L268). The boundary (L320) is enforced at the data layer (L320), not just the app (L320).

Q: What's the L134 payoff?

A: The L134 discipline (L134) — the tenant scoping, the leak checks, the row-level security (L134) — applied to the AI's surfaces (L320): the prompts (L312), the caches (L269), the vectors (L183), and the knowledge bases (L280). The multi-tenant AI SaaS (L357) lives on it (L320).

• What are the surfaces (L320)?
• What's the boundary (L320)?
• Where does the data leak (L320)?
• How do you enforce it (L320)?
• What's the L134 payoff (L134)?

The senior read: the left column is the L134 payoff (L320).

// The tenant isolation (L320) — the tenant ID everywhere (L320).
// 1 · THE RETRIEVAL (L189) — the tenant's filter (L180).
const chunks = await vectorStore.search(query, {
  topK: 5,
  filter: { tenantId: { equals: tenant.id } },   // the metadata filter (L180, L320)
});

// 2 · THE CACHE (L269) — the tenant's key (L320).
const cacheKey = `tenant:${tenant.id}:resp:${hash(prompt)}`;   // L320
const cached = await redis.get(cacheKey);        // L269

// 3 · THE PROMPT (L312) — the tenant's context only (L320).
const context = buildContext(chunks);            // the tenant's chunks (L320)

// 4 · THE STORES (L320) — the row-level and the prefixes (L320).
//   the RDS (L268): SELECT ... WHERE tenant_id = $1   (L134)
//   the S3 (L265): s3://docs/tenant/{id}/...           (L265)
//   the knowledge base (L280): the per-tenant kb       (L320)

// 5 · THE AUDIT (L322) — the tenant's record (L320).
await audit.log({ tenantId: tenant.id, action, at });   // L322

What the reader must SEE — the boundary, applied:

  filter: tenantId        → the retrieval's lock (L180, L189)
  tenant:{id}:resp:{hash} → the cache's lock (L269, L320)
  the tenant's context    → the prompt's lock (L312, L320)
  WHERE tenant_id = $1    → the row-level (L134)
  s3://docs/tenant/{id}/  → the prefix (L265)
  tenantId in the audit   → the record (L322)

  The tenant ID everywhere — the L134 payoff (L320).

• The filter is the retrieval's precision (L320). The tenant's metadata (L180) — the index (L183) narrowed (L189) — the retrieval (L189) faster (L320).
• The key is the cache's isolation (L320). The tenant's prefix (L320) — the misses (L320) for the other tenants (L320).
• The row-level is the DB's cost (L134). The tenant's column (L134) — the indexed (L134) — the queries (L320) fast (L320).
• The per-tenant bases are the storage's cost (L280). The duplicated indexes (L183) — the isolation (L320) for the storage (L285).

• The tenant isolation = the L134 payoff (L320): the surfaces, the boundary, the leaks, the enforcement.
• The surfaces: the prompts (L312), the caches (L269), the vectors (L183).
• The boundary: the tenant ID everywhere (L320).
• The leaks: the cross-tenant retrieval (L189), the shared caches (L269).
• The enforcement: the row-level (L134), the prefixes (L265), the filters (L189).

TENANT ISOLATION FOR AI = the L134 discipline, AI-shaped

THE SURFACES (L320)
  the prompts (L312) · the caches (L269) · the vector stores (L183)
  the knowledge bases (L280) · the logs (L329)

THE BOUNDARY (L320)
  the tenant ID everywhere (L320)
  the prompt's context (L320) · the cache's key (L269)
  the vector's metadata (L180) · the log's record (L322)

THE LEAKS (L320)
  the retrieval without the filter (L189)
  the cache without the key (L269)
  the knowledge base shared (L280)

THE ENFORCEMENT (L320)
  the row-level security (L134) — the RDS (L268)
  the prefix scoping (L265) — the S3 (L265)
  the retrieval's filters (L189) — the vectors (L183)
  the per-tenant bases (L280) — the knowledge (L280)

INTERVIEW, 4 MOVES
  1 surfaces  "the prompts, the caches, the vectors (L320)"
  2 boundary  "the tenant ID everywhere (L320)"
  3 leaks     "the cross-tenant paths (L320)"
  4 enforcement "the row-level, the prefixes, the filters (L320)"

You now hold the isolation: the surfaces, the boundary, the leaks, and the enforcement — with the tenant ID at every door. The apartment building is locked per floor — and the L134 payoff is banked (L320).

Next: where the model keys live, and how they never reach the client — Secret Management (L321).