A company is designing an AI security architecture for a multi-tenant SaaS application where different enterprise customers' data must be strictly isolated. The application uses a shared Azure OpenAI deployment. Which architectural pattern ensures tenant data isolation at the AI layer?

B is correct because in a multi-tenant SaaS architecture with a shared Azure OpenAI deployment, tenant isolation must be enforced at the application tier, not at the AI model level. The application must: (1) authenticate each request to verify which tenant is making the call, (2) authorize access to only that tenant's data store, (3) retrieve only that tenant's documents and records for context, and (4) ensure the context window passed to Azure OpenAI contains only the authenticated tenant's data. The AI model itself does not understand tenant boundaries—it processes whatever is in the prompt. A is wrong because relying on system prompt instructions to prevent cross-tenant data leakage is not a reliable security control; the model can be jailbroken or may hallucinate cross-tenant information. C is wrong because deploying separate Azure OpenAI deployments per tenant solves isolation but is cost-prohibitive at scale and not necessary if proper application-tier isolation is implemented. D is wrong because content filtering blocks harmful content categories (hate, violence); it cannot detect or block tenant-specific data in responses.