Tenant isolation must constrain retrieval filters, memory keys, tool credentials, caches, logs, traces, artifacts, sandboxes, and model requests. A tenant identifier in a prompt is context, not enforcement; the boundary must be applied by trusted application and data layers and tested with adversarial cross-tenant requests.