The application decides the tenant—not the AI model. Derive tenant scope from verified identity and server-held session context, then authorize each tool call immediately before it reads data or causes side effects. The model can choose an operation and supply its ordinary arguments; it should not choose which tenant’s data the operation may reach.
What the guard should decide
A tool call has two distinct inputs: what the model wants to do, and the authority under which the application may do it. Keep those separate. For example, the model may request read_invoice(invoice_id). The application obtains the tenant scope from authenticated request context and checks whether that principal may read that invoice within that scope.
Do not put tenant_id in a model-controlled tool schema and treat it as the source of authority. Even if the server later validates the value, the model can steer the requested scope through that argument. The preprint The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents, dated September 13, 2026, argues that removing tenant identity from the tool signature removes this argument-steering route. It also documents other assumptions about preserving scope, so removing the argument is not a complete isolation guarantee.
Place authorization on the execution path
A useful mental model is:
verified principal + server-held tenant scope → authorization guard(tool, resource) → operation
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Construct request context in trusted authentication middleware, pass it to a guard, and invoke the operation only after an explicit allow decision. The check belongs before protected data access and before side effects—ideally before network I/O when the policy does not permit the call. The af_mcp_client crate describes itself as a “Fail-closed MCP client over Streamable HTTP” and says it evaluates product authorization before network I/O. That is one implementation’s placement choice, not a rule that every application must use that crate or architecture.
Conceptual Rust-shaped pseudocode:
async fn read_invoice(ctx: &RequestContext, invoice_id: InvoiceId) -> Result<Invoice, Denied> {
let scope = ctx.tenant_scope().ok_or(Denied)?;
let decision = policy.authorize(&ctx.principal, scope, "invoice.read", &invoice_id)
.await
.map_err(|_| Denied)?;
if !decision.is_allow() {
return Err(Denied);
}
repository.read_invoice(scope, invoice_id).await.map_err(|_| Denied)
}This sketch illustrates the boundary; it is not tested production code. A real implementation must define its error handling, resource lookup, policy semantics, and safe response behavior. Treat missing identity, invalid or absent scope, and policy-evaluation failures as denials rather than silently broadening access or proceeding without a check.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What Rust and MCP do—and do not—provide
Rust does not automatically provide tenant isolation. The security property depends on where tenant scope comes from, whether every route to protected data passes through the check, whether denial precedes work, and whether scope remains intact through async tasks, database connections, and delegated calls.
MCP is a relevant protocol context, not a requirement for this pattern. The project describes rmcp as “The official Rust SDK for the Model Context Protocol”; it supports building MCP servers that expose tools and clients that connect to them. The same authorization boundary applies to non-MCP tool systems.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Tool visibility is useful, but it is not authorization
Filtering which tools a model can see can reduce accidental or unnecessary capability exposure, but the code that executes a tool still owns authorization and approval. For example, tower-mcp documents filtering tools, resources, and prompts based on session state, including a write guard that exposes write tools only when a session predicate succeeds. That can complement an execution-time check; it should not replace one.
ADK-Rust documentation makes the distinction explicit: its manager does not grant tool approval, and the application must apply its own authorization and approval policy. In practice, a tool hidden during discovery could still be invoked through another route, an older client, or a direct internal call. Enforce policy at the execution boundary that protects the data or action.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to evaluate a guard design
- Identity provenance: Is the principal authenticated and is tenant scope derived from trusted server-side context rather than a model argument?
- Complete coverage: Do all tool entry points, database queries, background jobs, and delegated calls that can reach tenant data pass through equivalent checks?
- Decision timing: Does a denial happen before data access, external requests, writes, or other side effects?
- Scope continuity: Does the same authorized scope remain attached through async work, connection reuse, and service-to-service delegation?
- Audit value: Can logs show the authenticated principal, resolved scope, requested capability/resource, decision, and whether execution followed—without exposing unnecessary sensitive data?
What the published study does—and does not—show
The authors of the September 13, 2026 preprint report 373 trials across eight model configurations and two transports. In their tested configuration, a correctly validated tenant parameter served every out-of-scope attempt: 26 of 26 attempts, or 26 of 41 plausible-pretext trials overall. When the tenant parameter was removed, no tool signature could express that read, but 12 of 56 trials instead escaped the interface by forging writable scope.
Those figures describe that study’s setup, not general failure rates or proof that a Rust guard is secure. The evaluation used a Python FastMCP implementation and particular SQL engines; it is not a performance evaluation of Rust guard code. The authors also warn: “It is not a machine-checked proof: we have no formal model of the system, no mechanized refinement from specification to code, and consequently no guarantee that the implementation realizes the invariants everywhere.”
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Test the denial boundary and its bypasses
Tests should verify both the policy result and whether protected work ran. Include cases for missing identity, missing or invalid tenant scope, policy-service failure, a principal requesting another tenant’s resource, and an allowed request. For denials, assert that the repository, downstream client, or side-effecting operation was not called.
Then trace every path to tenant data rather than testing only the model-facing tool handler. A direct repository call, alternate endpoint, async job, or delegated service can bypass a guard placed on only one route. The strength of the claim comes from trusted inputs and complete call-path coverage—not from a short Rust function in isolation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
