Tenant-safe Support Agent
A multi-tenant support workflow where identity and authorization are enforced at every tool boundary.
A reference implementation for testing the production contract of a support agent: who it acts for, which data it may see, what evidence supports an answer, and when a human must take control.
Constraints
- No cross-tenant reads, even when a prompt asks for another account.
- Answers must be grounded in the synthetic documentation corpus and cite their sources.
- State-changing tools require explicit approval and are denied by default.
- Prompt injection, poisoned documents, PII exposure, and malicious tool input are first-class test cases.
Architecture
A LangGraph workflow separates identity, retrieval, reasoning, policy checks, tools, and response assembly. Tenant identity is server-owned context, never model-authored input. Every tool independently validates tenant scope and action policy. Optional Bedrock and OpenRouter composers receive only authorized, sanitized evidence and cannot change policy or approval state.
Security and failure modes
The threat model covers cross-tenant access, indirect prompt injection, unauthorized writes, over-broad tools, fabricated citations, and sensitive-data disclosure. Safe refusal and human escalation are valid outcomes.
Operations and evaluation
The committed corpus contains 120 synthetic cases: 30 grounded-documentation queries, 24 authorized reads, 24 cross-tenant attempts, 18 prompt-injection cases, 12 unapproved writes, and 12 approved writes. Every run writes case-level JSONL plus JSON and Markdown summaries.
Results
Deterministic policy baseline, 4 August 2026: 120/120 cases passed, with zero cross-tenant leaks, zero unauthorized writes, and 100% citation completeness across 75 cited responses. Median harness latency was 0.667 ms and p95 was 0.802 ms. Estimated model cost was $0 because this baseline intentionally made no model call.
These results verify the synthetic policy harness, not model quality, end-to-end production latency, compliance, or universal prompt-injection resistance. See the committed evaluator artifacts in the public repository for the exact claim boundary.
Trade-offs
The design accepts extra tool calls and policy checks in exchange for explicit authorization and auditable behavior. It favors narrow, typed tools over a general-purpose action surface. Model-backed runs must be evaluated separately because behavior, latency, and cost are different variables.
Technology choices are included here for implementation context; the case study above carries the architectural argument.