Phase 3.5 extraction & assembly
Four new ISO-MCP-* cases covering MCP-specific tenant isolation: cross-org agent access, suspended agent handling, and extraction worker RLS enforcement.
Milestone 3.5.F.2 — Cross-Tenant Isolation Matrix
Status: Completed
Goal: Track F — Exit Gate
Phase: 3.5 — Extraction & Context Assembly
Estimated effort: 2 days
Track: Track F — Exit Gate
Depends on: Milestone 3.5.F.1 (E2E suite)
Test Matrix
| Case ID | Scenario | Expected | Environment |
|---|---|---|---|
| ISO-MCP-01 | Org A's org-scoped PAT + Org B agent_id on search_memory and write_memory (ValidateAgent cross-org; not agent-binding) | permission_denied MCP error, never not_found; zero memory HTTP | Live Postgres + auth + memory HTTP |
| ISO-MCP-02 | Org A's org-scoped PAT + Org A agent created_by User B | Allowed (isError false / memory 200) | Live Postgres + auth + memory HTTP |
| ISO-MCP-03 | Agent-scoped PAT for suspended agent on search + write | permission_denied via ValidateAgent | Live Postgres + auth + memory HTTP |
| ISO-MCP-04 | Extraction with forged org_id=OrgA, session_id=OrgB | session_not_found; zero memory POSTs; pointer unchanged | Live Postgres + MockTransport HTTP |
Orientation (indicative)
Areas involved:
- MCP server (
services/mcp-memory) —GRPCAgentVerifier+ tool call site - Authclient ValidateAgent codec
- Worker extraction session store (ISO-MCP-04)
- CI job
security-integration-p35(infra/scripts/security-integration-p35.sh)
Success signals
- All 4 ISO-MCP-* cases automated (min-count floor 4 in CI)
- CI job
security-integration-p35enforces minimum test count - Repo guards / CI checks still pass
Prerequisites
- Milestone 3.5.F.1 (E2E suite)
- Milestone 3.5.E.2 (MCP tools)
Edit on GitHub
Last updated on