Software as a Service Platforms

Shipping an AI feature to tenants changes the question. What the model can do matters less than what it can reach. One customer must never see the material of another. This starter gives you a tool boundary and a data screen, and leaves tenant separation in your retrieval layer.

The permitted tool list holds one entry, document search. Everything a support assistant might use to change tenant records is blocked, including a shell, code execution and a database write. Tool call analysis runs on the gateway, so customer prompts are not forwarded to another vendor for inspection.

On the request, injection screening runs before anything else. Masking then covers API key and session identifier patterns, the two shapes most often pasted by a customer in a support thread. A block list refuses the words private key, secret and token.

Answers must reach a combined 0.78, with relevance 0.78 and accuracy 0.80, and at least 120 characters across two sentences. A shorter or weaker reply is refused. Scoring and the review point do not run on streamed output, so a token by token chat bypasses both.

Scope your document search index per tenant, because the starter does not know your tenancy model. This chain also has no role check, so entitlement stays with your application. Evidence here supports SOC 2 Type II and ISO 27001 questions about tool restriction and monitoring. The Data Analytics starter shares these floors and suits internal work, where no tenant boundary applies.