Multi-tenant AI agent marketplace
How does PostQode isolate multi-tenant AI agent marketplace data?
Rupam Das architected two-layer multi-tenancy at PostQode so purchased AI agents cannot cross tenant data: Prisma middleware plus SQL Server RLS on 35 of 100 models, CI that fails unscoped queries, and ARM deploys into each buyer’s Azure subscription.
Architected two-layer multi-tenancy for a 100-model, 61-route backend so purchased AI agents cannot cross tenant data — then deployed those agents into buyers’ own Azure subscriptions.
·
The constraint
A marketplace of agents is a tenancy and supply-chain problem before it is an LLM problem. One unscoped query, or one shared network path, collapses trust.
Architecture
Prisma middleware plus SQL Server row-level security via session context on 35 tenant-scoped models. CI guards fail any unscoped query. Azure Front Door, APIM, full VNet isolation, and private-endpoint SQL sit in front of an ARM orchestrator that deploys into buyer subscriptions with automated rollback. License checks use an in-process LRU plus Redis. Trivy, SBOM, and Notation signing run on every image. Architecture invariants cover a 21-domain, ~232-service codebase.
Sources / stack
- Prisma
- SQL Server RLS
- Azure Front Door
- APIM
- VNet isolation
- ARM
- Redis
- Trivy
- SBOM
- Notation
Isolation stack
- 01Edge
- Front Door
- APIM
- 02Network
- VNet isolation
- Private-endpoint SQL
- 03Application
- Prisma middleware
- Session-context RLS
- LRU + Redis licenses
- 04Delivery
- ARM orchestrator
- Automated rollback
- Trivy / SBOM / Notation
What we measured
Tenant-scoped models
Two-layer isolation across a 100-model backend
Baseline: 100
Backend surface
CI blocks any unscoped query before merge
Service graph
Invariants across 21 domains: tenancy, imports, OpenAPI/DB drift
Result
Defense-in-depth isolation on 35 models; CI as a tenancy control plane; buyer-subscription deploys with rollback; signed, scanned artifacts on the path to production.