The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents
A structural defense is presented: remove tenant identity from the Model Context Protocol (MCP) tool schema, bind scope to a verified credential, and enforce it below the agent, resulting in a tenant-isolation argument that depends on enforceable interfaces and credentials rather than model compliance.