Track 06 · Security & risk reviewLesson 07 of 10
Authorization and multi-tenancy
RBAC, ABAC and tenant isolation: the least privilege auditors actually check.
- Specialisation · Government
- 30 min read
- 75 min hands-on
- Halden Freight
- Pro
What you'll be able to do
01- Explain authentication versus authorisation, and RBAC versus ABAC versus ReBAC, and choose a mix for a given enterprise.
- Design an agent authorisation path where a deterministic enforcement point checks every tool call, as the user and capped by the agent, with deny by default.
- Implement per-tool-call and per-argument policies, separation of duties and a decision log a security reviewer can read.
- Choose a tenancy model (silo, pool or bridge) and enforce isolation at every layer an agent touches: database, vector index, cache, context window, memory, logs and evals.
- Prove isolation with cross-tenant leakage tests in CI, and defend why "the system prompt tells it not to" is not a control.
Before you start
- SSO and provisioning for agents: where identity, groups and roles come from, and how identity reaches the agent.
- Tools with scoped, auditable access: per-tool OAuth scopes, on-behalf-of versus service identity.
- Retrieval that respects who can see what: ACL filtering inside the retrieval pipeline.
- Defending against prompt injection: why model output is untrusted input.
- Background: you have written a SQL
WHEREclause and read a JWT's claims.
The short version
Authentication says who is asking; authorisation decides what they may do, to which resource, in which context. For an agent the question at every tool call is: may this user, acting through this agent, perform this action on this resource with these arguments, right now? The answer comes from deterministic policy outside the model, at an enforcement point the agent cannot route around. Effective permission is the intersection of what the user may do and what the agent may do, and anything not explicitly permitted is denied. In a multi-tenant system the tenant boundary is a guardrail no permit can cross, enforced in every layer that holds tenant data and proven with tests.
- The model is never a principal. Identity and tenant come from the verified session, never from model output.
- Authorise as the user, cap by the agent. User ∩ agent ∩ tenant, deny by default.
- Policy as code. Roles for the coarse grain, attributes and relationships for the fine grain, versioned and tested.
- Isolation is per layer. A tenant filter on the database does nothing for the semantic cache.
- Evidence beats assurance. Leakage tests and decision logs are what the security team audits.
Pro lesson
The rest of this lesson is in Pro.
The mental model, worked example, field note, failure table, exercise and self-check, with the voice tutor.
- Every stage and specialisation, in full
- Every lab and every role project
- Halden weeks 2–10, on your record
- Every drill, live in the playground
- All solutions, plus the server judge
- Lab Assistant and every Teach with AI