A company is designing an AI security architecture for a multi-tenant SaaS application where different enterprise customers' data must be strictly isolated. The application uses a shared Azure OpenAI deployment. Which architectural pattern ensures tenant data isolation at the AI layer?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you enforce tenant isolation at the application layer, not by asking the model nicely. You authenticate and authorize each request, pull only that tenant's data from isolated storage, and send only that tenant's data into the context window.
Full Explanation
Tenant isolation must be enforced at the application tier, not at the AI model level, in a multi-tenant SaaS architecture with a shared Azure OpenAI deployment. The application must authenticate each request to verify which tenant is making the call, authorize access to only that tenant's data store, retrieve only that tenant's documents and records for context, and ensure the context window passed to Azure OpenAI contains only the authenticated tenant's data. The AI model itself does not understand tenant boundaries—it processes whatever is in the prompt. Using a single system prompt instructing the model not to reveal other tenants' data is wrong because relying on prompt instructions to prevent cross-tenant data leakage is not a reliable security control; the model can be jailbroken or may hallucinate cross-tenant information. Deploying a separate Azure OpenAI deployment per tenant is wrong because it solves isolation but is cost-prohibitive at scale and not necessary if proper application-tier isolation is implemented. Applying Azure OpenAI content filtering to block tenant identifiers in responses is wrong because content filtering blocks harmful content categories such as hate and violence; it cannot detect or block tenant-specific data in responses.