The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents
Baig and colleagues formalize what happens when a multi-tenant tool asks an LLM agent to supply the tenant identifier, and show that removing the parameter from the tool schema is a stronger defense than validating it.
Ask this paper
The agent is an untrusted deputy. A tool that accepts a tenant id and checks it against the caller's entitlement has delegated resource selection to a process whose context may contain attacker-controlled instructions.
The structural fix. Remove tenant identity from the Model Context Protocol tool schema, bind scope to a verified credential, and enforce it below the agent, so no tool signature can express an out-of-scope read.
Validation alone does not hold. In a 373-trial ablation across eight model configurations and two transports, a correctly validated tenant parameter still served every out-of-scope attempt, 26 of 26.
Removing the parameter is not sufficient on its own. Twelve of 56 trials escaped by forging writable scope, which is the authors' evidence that interface invariance requires cryptographically protected context.
A measured performance cost. On a production dataset of several GB, set-valued scope produced a 57x latency ratio under function-wrapped membership predicates, and a JSON_TABLE lateral join recovered index access where the tenant key was indexed.
Abstract
Multi-tenant tools commonly accept a tenant identifier and validate it against the caller's entitlement. For a large language model (LLM) agent, that pattern delegates resource selection to a process whose context may contain attacker controlled instructions. We formalize this stochastic deputy problem and present a structural defense: remove tenant identity from the Model Context Protocol (MCP) tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation across eight model configurations and two transports, a correctly validated tenant parameter served every out-of-scope attempt: 26 of 26, or 26 of 41 plausible-pretext trials overall. With the parameter removed, no tool signature could express the read. Twelve of 56 trials instead escaped the interface by forging writable scope, showing that interface invariance requires cryptographically protected context. On a production dataset containing multiple GBs of data, set-valued scope caused a measured $57\times$ latency ratio under function-wrapped membership predicates; a JSON_TABLE lateral join recovered index access where the tenant key was indexed. The evaluation also exposes deployment limits, including an entitlement-size query-planner cliff and incomplete index coverage. The result is a tenant-isolation argument that depends on enforceable interfaces and credentials rather than model compliance.