Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use
This paper addresses the critical security gap in multitenant enterprise AI systems where retrieval relevance overrides authorization by proposing and validating a server-side, layered isolation architecture within the open-source OGX framework that enforces policy-aware ingestion and retrieval gating to prevent cross-tenant data leakage with negligible performance overhead.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a massive, high-tech library where thousands of different companies (tenants) have rented shelves to store their secret documents. In this library, there are also powerful robots (AI agents) hired to find specific information and perform tasks based on what the companies ask.
The paper by Arceo and Narsing identifies a dangerous flaw in how these libraries currently work and proposes a new security system to fix it.
The Problem: The "Relevance" Trap
In a normal library, if you ask for "recipes," the librarian hands you the books that are most relevant to that word. They don't care who owns the books; they just grab the best matches.
The authors point out that in the AI world, this is a disaster for security.
- The Scenario: Company A asks the robot, "How do we fix our server?"
- The Mistake: The robot searches the whole library. It finds a document from Company B that is very similar to the question (maybe it's about fixing a server too).
- The Leak: Because the document is a "perfect match" for the question, the robot hands it over. Company A just read Company B's secret server manual.
The paper calls this the "Relevance-Authorization Gap." The system is great at finding what is relevant, but terrible at checking who is allowed to see it.
The Solution: The "Layered Isolation" Building
To fix this, the authors propose a new building design with three specific security layers and a strict rule about who holds the keys.
1. The Three Layers of Security
Think of the data journey like a package going through a secure facility:
Layer 1: The Labeling Station (Policy-Aware Ingestion)
When a company drops off a box of documents, the system immediately stamps every single page with a "Company A" or "Company B" label. You can't forget to label them later; it happens the moment they arrive. This ensures every piece of paper knows who it belongs to.Layer 2: The Security Gate (Retrieval Gating)
Before the robot is even allowed to look for books, it must pass through a security gate. The gate checks the user's ID badge.- If the user is from Company A, the gate physically blocks the aisle containing Company B's books.
- The robot never sees the forbidden books, so it can't accidentally hand them over. This is called ABAC gating (Attribute-Based Access Control).
Layer 3: The Shared Brain (Shared Inference)
The actual "thinking" part of the robot (the AI model) is shared by everyone to save money. Usually, you might think you need a separate robot for every company to keep secrets safe. But because Layers 1 and 2 ensure that only the correct, labeled documents are ever fed to the robot, the robot can safely be shared. It's like a chef cooking for everyone, but the ingredients are pre-sorted so the chef never accidentally uses a customer's secret recipe in another customer's dish.
2. The "Server-Side" Rule
The paper argues that the security checks must happen inside the building (the server), not outside in the customer's office (the client).
- The Old Way (Client-Side): The customer's computer does the searching and checking. A sneaky customer could just turn off their security software, ignore the rules, and ask the robot to look at everything.
- The New Way (Server-Side): The customer sends a request, but the building's internal security team does all the searching, tool-using, and checking. The customer can ask for a "red car," but they can't tell the security team to ignore the rules and show them a "blue car" that belongs to someone else. The building controls how the search happens, ensuring the rules are never broken.
The Results: What They Tested
The authors built a prototype system called OGX (Open GenAI Stack) to test this idea. They ran experiments with fake companies and tricky questions to see what happened.
- Security: Without the new security gate, 98–100% of the time, the robot leaked secret documents from other companies. With the new gate, 0% of the secrets were leaked. The security gate completely stopped the leaks.
- Speed: Adding the security gate slowed things down by a tiny amount (about 19 milliseconds). This is like adding a split-second pause to a conversation—unnoticeable to humans but crucial for safety.
- Quality: Because the robot wasn't confused by irrelevant documents from other companies, it actually found the right answers faster and more accurately.
The Bottom Line
The paper concludes that you can have a shared, cost-effective AI system for many different companies without them stealing each other's secrets. You just need to stop trusting the "relevance" of a search result and start enforcing strict "permission" checks at the door, all managed by a central security team inside the server.
They emphasize that this is a vendor-neutral solution, meaning it doesn't lock you into one specific AI company (like OpenAI or Google); it works with any open-source or commercial AI tools you choose.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.