How are you preventing cross-tenant data leakage in AI agents?

As AI agents get access to customer records, RAG pipelines and persistent memory, I think one issue deserves more attention: authorization at the evidence layer.

It is not enough for an LLM to retrieve relevant information. It also needs to know whether that evidence is authorized for this specific requester, tenant and response.

While building AletheionAGI, we started treating this as an enforcement problem:

retrieval / memory → authorization → evidence → LLM → claim validation → deliver or fail closed

I’m curious how other teams are handling this today.

Are you relying mostly on application-level ACLs, prompt guardrails, isolated vector stores, post-generation validation, or something else?

And where do you think the strongest boundary should live?