The original title is "Never Let the Model Pick the Tenant ID: Securing an LLM Agent in Go"

Short summary

A Go developer shares a production-grade security model for LLM agents and MCP servers, centered on one rule: the server decides the user identity, never the model. The article covers prompt injection as the top OWASP risk for LLMs, why accepting model-proposed tenant IDs is dangerous, and practical hardening patterns using Anthropic SDK, Postgres, Redis, and Keycloak. Concrete examples include a model literally sending 'your_tenant_id' as an identifier.

• •LLM agents with tools are untrusted clients holding production credentials — treat every tool argument as attacker input
• •Never let the model pick the tenant_id; server-side identity enforcement is rule #1
• •Covers prompt injection, MCP server exposure, and Anthropic's Agentic Misalignment study findings

Generated with AI, which can make mistakes.