How do you ensure tenant isolation when multiple customers share the same agent?

"Three levels of isolation, choose based on sensitivity:

• (1)Row-level security (cheapest) — shared infrastructure, data filtered by tenant_id in every query. Good for low-sensitivity SaaS.
• (2)Namespace isolation — shared compute but separate vector indices, separate KMS keys, separate logging sinks per tenant. Good for mid-tier.
• (3)Project-level isolation (strongest) — separate GCP project per tenant with its own VPC-SC perimeter, CMEK, and service accounts. Required for regulated industries. The agent's MCP tools enforce the isolation layer — the LLM has no concept of tenants. Critical: test isolation — run adversarial queries like 'show me data from tenant B' and verify zero cross-contamination."