Agent database access for multi-tenant SaaS
Let AI agents query a shared multi-tenant database without ever crossing a tenant boundary. Every query is scoped by tenant_id automatically.
The problem
In a multi-tenant product, a single leaked row is a breach. If your agent builds queries from natural language, one missing WHERE tenant_id = ? clause exposes another customer’s data — and prompt injection makes that clause easy to lose.
With OrmAI
OrmAI injects the tenant filter at the runtime boundary, not in the prompt. The agent never receives, and cannot override, the tenant identifier. Cross-tenant reads and writes become structurally impossible rather than a code-review checklist item.
The primitives doing the work
Automatic tenant scoping
tenant_id from the RunContext is added to every query and every write; the agent cannot see or set it.
Immutable audit log
Every access records the principal, tenant, and policy decision, so you can prove isolation held.
Gated writes
Mutations are limited to approved models and always carry the tenant scope.
The policy, in a few lines
policy = (
PolicyBuilder(DEFAULT_PROD)
.register_models([Customer, Invoice, Ticket])
.tenant_scope("tenant_id") # injected from RunContext, never the prompt
.mask_fields(["email", "phone"])
.build()
)Keep reading
Other use cases