Multi-Tenant LLM Isolation

# Moltbot multi-tenant conversation isolation:
multi_tenant:
  isolation_model: strict     # strict | permissive | none

  # Each request is tagged with tenant_id from authenticated JWT:
  tenant_id_source: jwt_claim  # Extract tenant_id from JWT "sub" or "org_id"
  tenant_id_claim: "org_id"

  conversation_isolation:
    storage_key_prefix: "tenant:{tenant_id}:conv:{session_id}"
    # Conversations physically separated by tenant prefix in storage

    # NEVER allow cross-tenant context injection:
    cross_tenant_context: deny
    # This means: a user cannot reference another tenant's conversation history

    # System prompt isolation:
    system_prompt:
      per_tenant_config: true   # Each tenant has own system prompt
      tenant_cannot_override_base: true  # Base safety rules always apply

  # Session isolation validation (paranoid mode):
  session_validation:
    verify_tenant_on_every_request: true  # Don't trust session cache — re-verify
    session_token_binding: true  # Session token bound to tenant_id at creation

  # Emergency isolation: if cross-tenant leak suspected:
  on_isolation_breach:
    action: terminate_all_tenant_sessions
    alert: immediate
    log_forensic: true

# Moltbot RAG multi-tenant partitioning:
rag:
  isolation_strategy: namespace  # namespace | separate_collection | separate_db

  # Strategy: namespace (most common — single vector DB, logical separation):
  namespace_config:
    namespace_key: "tenant_id"
    namespace_format: "t_{tenant_id}"  # e.g., t_acme, t_beta_corp

    # All queries are automatically namespaced:
    # query(text, tenant_id="acme") → searches ONLY in namespace "t_acme"
    # Cannot be overridden by user input

    # Namespace enforcement at query layer (not application layer):
    enforce_at: vector_db_client  # Not at app level — harder to bypass

  # Strategy: separate_collection (stronger isolation, more resources):
  # Each tenant gets their own Chroma/Weaviate/Qdrant collection
  # Physical separation — no shared index structures

  # Strategy: separate_db (strongest — for high-compliance tenants):
  # Each high-value tenant gets dedicated vector DB instance
  # Used for: enterprise tiers, regulated industry tenants

  # Cross-tenant retrieval prevention:
  retrieval_validation:
    verify_namespace_before_return: true  # Double-check every result
    on_namespace_mismatch: drop_and_alert  # Drop result + alert security

  # Tenant data deletion (GDPR Art. 17):
  tenant_offboarding:
    delete_namespace: true       # Delete entire namespace on tenant deletion
    verification_scan: true      # Verify no documents remain after deletion

# Moltbot per-tenant encryption key management via Vault:
encryption:
  key_strategy: per_tenant

  vault_config:
    # Each tenant has a dedicated encryption key in Vault:
    key_path_template: "transit/keys/tenant-{tenant_id}"

    # Create key for new tenant:
    # vault write transit/keys/tenant-acme type=aes256-gcm96

    # Encrypt tenant data:
    # vault write transit/encrypt/tenant-acme plaintext=$(base64 <<< "conversation data")

    # Tenant key rotation (without re-encrypting all data — Vault handles):
    rotation_policy:
      auto_rotate_days: 90
      min_decryption_version: 1  # Keep old versions for decryption

  # What is encrypted per tenant:
  encrypted_per_tenant:
    - conversation_logs          # Full conversation history
    - rag_document_store         # Vector store documents
    - agent_memory               # Persistent agent memory
    - user_preferences           # User-level personalisation data
    - audit_logs                 # Encrypted separately for tamper evidence

  # Key access audit:
  key_access_logging: true
  # Every time tenant key is used, log: tenant_id, operation, timestamp, requestor
  # Alert if: key used from unexpected service, key accessed outside business hours

# Moltbot cross-tenant leakage detection:
leakage_detection:
  enabled: true

  # 1. Output scanning for other tenants' data patterns:
  cross_tenant_output_scan:
    # Scan LLM output for content that should only exist in another tenant's corpus
    # Uses tenant-specific fingerprints (hashes of unique phrases per tenant)
    fingerprint_check: true
    fingerprint_store: redis      # In-memory for speed
    action_on_detect: block_and_alert_security

  # 2. Context window validation before LLM submission:
  context_validation:
    # Before sending context to LLM, verify all items in context belong to
    # the current tenant (by checking namespace/tenant_id metadata)
    validate_all_context_items: true
    on_foreign_item: remove_and_log  # Remove foreign item, continue, log

  # 3. Statistical anomaly detection:
  # Track: distribution of tenant_ids in retrieved RAG results per request
  # Alert if: results from unexpected tenant namespaces appear (even 1)
  statistical_monitoring:
    track_namespace_distribution: true
    alert_threshold: 0  # Any cross-namespace result = alert

  # 4. Periodic isolation audit:
  isolation_audit:
    schedule: "0 2 * * 0"  # Weekly Sunday 2am
    test: inject_canary_documents_per_tenant
    # Inject unique canary documents per tenant — verify they never appear
    # in queries from other tenants
    on_canary_detected_cross_tenant: critical_alert