The agent is a new principal

When an agent acts, who is it acting as? The dangerous default is "the app" — the agent runs with the service's broad credentials, so any user can make it do anything the service can. The correct model: the agent acts as the user, inheriting that user's permissions and no more. This is permission propagation, and getting it wrong is how "summarize my tickets" becomes "read everyone's tickets."

def agent_tools_for(user):
    # Tools must enforce the ACTING USER's permissions, not the app's god-mode credentials.
    def get_ticket(ticket_id):
        t = db.get_ticket(ticket_id)
        if t.owner_id != user.id and not user.is_admin:      # authorization check INSIDE the tool
            raise PermissionError("not your ticket")          # the agent cannot exceed the user's rights
        return t
    return {"get_ticket": get_ticket}                         # every tool scoped to `user`
# Combined with least privilege (last topic): the agent gets the intersection of "tools it needs" and
# "what this user may do" — never the app's full authority.

PII: detect, minimize, redact

Personal data (names, emails, phone numbers, IDs, health/financial info) flowing to a third-party model is a privacy and compliance exposure. Three habits, in order of importance:

1. Minimize — don't send PII the task doesn't need. The best protection for data is to never transmit it.
2. Redact — replace PII with placeholders before the model sees it, and (if needed) restore in the output.
3. Detect — scan inputs/outputs for PII you missed (regex for structured PII, NER/Presidio for names).

import re
def redact(text: str) -> tuple[str, dict]:
    mapping = {}                                             # placeholder -> original, to restore later
    def sub(pattern, tag):
        nonlocal text
        for i, m in enumerate(re.findall(pattern, text)):   # find each PII instance…
            ph = f"[{tag}_{i}]"; mapping[ph] = m            # …assign a placeholder, remember the original
            text = text.replace(m, ph)                       # swap it out before the model sees it
    sub(r"[\w.]+@[\w.]+", "EMAIL")                            # emails
    sub(r"\+?\d[\d\s-]{7,}\d", "PHONE")                      # phone numbers
    return text, mapping

def restore(text: str, mapping: dict) -> str:
    for ph, original in mapping.items():
        text = text.replace(ph, original)                    # put real values back in the final output
    return text
# Flow: redact(user_input) -> send placeholders to the model -> restore(model_output) for the user.

Where does the data go?

Choosing a model is also choosing a data processor. Before sending data to a provider, know:

• Training use — will the provider train on your data? Business/enterprise API tiers typically don't train on inputs (consumer tiers may) — verify the specific terms.
• Retention — how long is data stored? Many APIs retain for a short abuse-monitoring window; zero-retention options exist for sensitive use.
• Residency — where is it processed? Regulated/EU data often must stay in-region → Azure OpenAI in an EU region, an EU-hosted provider, or a self-hosted open model.
• Sub-processors & compliance — SOC 2 / ISO / HIPAA / GDPR posture of the provider.

The decision: match data sensitivity to deployment. Public data → any hosted API. Sensitive/regulated data → enterprise tier with no-training + short retention, in-region, or a self-hosted open-weight model so the data never leaves your infrastructure at all.

Multi-tenant isolation — the RAG footgun

If you serve multiple customers (tenants) from one system, tenant A must never see tenant B's data. This is routine in normal apps (scope every query by tenant_id) but AI adds a sharp new edge: a shared vector index. If you embed all tenants' documents into one index and retrieve without filtering, a query can pull another tenant's chunk straight into the prompt — a silent, severe data breach.

def retrieve(query: str, tenant_id: str, k: int = 4):
    # ALWAYS filter retrieval by tenant — a missing filter leaks other tenants' documents into the context.
    return vector_store.search(embed(query), filter={"tenant_id": tenant_id}, k=k)   # non-negotiable scope
# Belt and suspenders: separate indexes/namespaces per tenant for hard isolation on sensitive workloads,
# so a forgotten filter can't cross the boundary at all.

The rule: every retrieval, DB read, and memory lookup carries the tenant scope, enforced in the data layer — never left to a prompt or the model's discretion. For high-sensitivity tenants, prefer physical separation (per-tenant index/namespace/database) so an application bug can't leak across the boundary.

Secrets and keys

Baseline hygiene the agent context makes easy to forget: keep API keys and DB credentials in a secrets manager / env vars, never in prompts, code, or traces (which log prompts — last topic). Rotate keys, scope them minimally, and never expose provider keys to the client. An agent that can read its own environment or echo its system prompt shouldn't have secrets in either.

Pitfalls

• Agent runs as the app, not the user. Broad service credentials + model-chosen rows = privilege escalation via injection. Propagate the user's permissions into the tool layer.
• Sending PII you don't need. Minimize first, redact second — the safest data is data you never transmit.
• Ignoring provider data terms. Verify training-use, retention, and residency before sending sensitive data.
• Shared vector index with no tenant filter. The classic RAG breach — scope every retrieval by tenant; physically separate sensitive tenants.
• Secrets in prompts/code/traces. Use a secrets manager; assume anything in context can leak.

Recap

• The agent is a new principal — enforce RBAC and permission propagation so it never exceeds the acting user's rights, in the tool/data layer (not the prompt).
• Handle PII by minimize → redact → detect; the safest data is data you never send.
• Choosing a model chooses a data processor — check training use, retention, residency, compliance; match data sensitivity to deployment (self-host open models for the most sensitive).
• Enforce multi-tenant isolation on every retrieval/read — a shared vector index without a tenant filter is a silent breach; physically separate sensitive tenants.
• Keep secrets out of prompts, code, and traces.
• Worked examples map to the exercises: permission-scoped tools (Ex 1), PII redact/restore (Ex 2), data-to- deployment matching (Ex 3), tenant-isolation test (Ex 4).

def tools_for(user):
    def get_ticket(ticket_id):
        t = db.get_ticket(ticket_id)
        if t.owner_id != user.id and not user.is_admin:
            raise PermissionError("not your ticket")     # authz enforced in the tool, with the USER's identity
        return t
    return {"get_ticket": get_ticket}

alice_agent = build_agent(tools_for(alice))
alice_agent("show ticket 999")   # ticket 999 belongs to bob -> PermissionError, even if the model tries

import re
def redact(text):
    mapping = {}
    def sub(pat, tag):
        nonlocal text
        for i, m in enumerate(re.findall(pat, text)):
            ph = f"[{tag}_{i}]"; mapping[ph] = m; text = text.replace(m, ph)
    sub(r"[\w.]+@[\w.]+", "EMAIL"); sub(r"\+?\d[\d\s-]{7,}\d", "PHONE")
    return text, mapping

def restore(text, mapping):
    for ph, orig in mapping.items(): text = text.replace(ph, orig)
    return text

clean, m = redact("Email jane@acme.com or call +33 6 12 34 56 78")
out = llm(f"Draft a reply to: {clean}")   # model sees [EMAIL_0], [PHONE_0] — never the real values
print(restore(out, m))                     # real contact details restored for the user

def retrieve(query, tenant_id, k=4):
    return vector_store.search(embed(query), filter={"tenant_id": tenant_id}, k=k)   # scope is non-negotiable

# The test that would have caught a real breach:
def test_tenant_isolation():
    vector_store.add(embed("ACME secret roadmap"), text="ACME secret roadmap", tenant_id="acme")
    vector_store.add(embed("Globex secret roadmap"), text="Globex secret roadmap", tenant_id="globex")
    hits = retrieve("secret roadmap", tenant_id="acme", k=10)
    assert all(h.tenant_id == "acme" for h in hits)          # Globex's doc must NEVER appear
    assert not any("Globex" in h.text for h in hits)