Tenant isolation: define the claim before choosing a control

A tenant is an authority domain: a customer, research group, or organization with a defined set of identities and permitted operations. A request’s tenant label must come from authentication and a trusted mapping. Copying a caller-controlled header into an accounting key allows the caller to spend somebody else’s budget or choose a fresh identity for every request. Trace this mapping through the gateway, asynchronous queue, worker, storage operation, and audit record. Losing the identity at a background handoff breaks both authorization and attribution.

Write separate obligations for confidentiality, integrity, availability, and fairness. Confidentiality concerns forbidden observations; integrity concerns forbidden changes. Availability includes continued service and bounded recovery under stated loads and failures. Fairness compares allocations against an entitlement policy. None implies the others: an equal scheduler does not authorize object reads, and denying object reads does not keep an overloaded shared device responsive. Also identify trusted components. Sharing a kernel or cluster administrator means that those components remain within the trust assumptions, even when ordinary tenants have separate namespaces.

Two requests are comparable only after choosing a cost model. An embedding request and a long autoregressive generation may have different accelerator time, memory residence, and network traffic. Equal request counts can therefore allocate unequal physical work. Conversely, equal GPU time may violate a policy that intentionally gives a larger customer twice the entitlement. Normalize observed service by the agreed entitlement before applying an equality metric. Preserve the original units and observation interval so that an attractive score cannot conceal low total throughput.

Jain’s index summarizes equality among nonnegative allocations, excluding the all-zero case. Its scale invariance is useful but also a limitation: uniformly tiny allocations score as highly as uniformly large ones. A score does not indicate whether deadlines were met, whether capacity was left idle, or whether a forbidden read succeeded. For an AI service, publish the vector of useful throughput, deadline success, errors, and relevant resource use beside the fairness calculation. Treat the score as one projection of an explicit service contract.

A tenant may be inside its CPU budget and still saturate a shared memory controller, metadata server, or admission webhook. Draw a resource path for each important operation instead of placing one generic box around a pod. Mark where a control applies, who can modify it, and what happens when its supporting service fails. A namespace may organize those controls, but it is not evidence that every shared dependency has acquired an independent fault or confidentiality boundary. The claim must name the dependencies it leaves shared.

Use the vector lab to represent two normalized demand dimensions. Reset, explicitly set angle 45 degrees and magnitude 2, predict both components, then Play or Step. For a separate comparison Reset and explicitly set angle zero and magnitude 2 before predicting again. The components change while the magnitude stays fixed; a scalar demand total cannot describe every resource constraint. This geometric model does not allocate cluster capacity or test tenant authorization. Its purpose is to make the lost information in a one-number isolation claim visible.