One user's data reached another user

Design it out

Enforce permissions before the model sees the data: per-tenant namespaces, access-control filtering at retrieval, and permissions kept in sync with the source.

• User-scoped access Tools act with the signed-in user's own permissions, never a shared service account.
• Permission filter at query time Filter retrieved chunks by the requesting user's permissions before they reach the model.
• Least-privilege tools Each tool does one narrow thing, with only the scopes the task needs.
• Output secret scanner Block replies that contain known secrets in common encodings.
• Permission sync and re-indexing Changes to access rights in the source systems are pushed to the index promptly.
• Tenant-isolated indexes Each customer's embeddings live in a separate index or namespace that queries can't cross.
• Trusted-source ingestion The knowledge base only ingests documents from approved, accountable sources.

The agent design check flags it as: Public users could ask it for data that isn't theirs; Its search could answer one person with another person's data.