Authorize the resolved tenant, model, version and adapter on every path

Derive tenant membership from verified server-side identity and policy rather than accepting a tenant field or header as authority. Resolve friendly model aliases to canonical model, version and adapter identities under a documented namespace. Check both the requested operation and its resolved targets; a permitted alias must not later switch to an unapproved version. A random-looking identifier reduces accidental discovery but does not replace an authorization check when the identifier is guessed, leaked or reused.

An illustrative policy can require permission for the base model and for each activated tenant adapter, together with compatibility and lifecycle state. Public/shared models can have explicit sharing rules, so ownership equality is not the only possible valid policy. Keep the chosen rule deterministic and deny missing or ambiguous context. Compatibility is another predicate: matching dimensions or successful adapter loading does not show that the caller may use its learned parameters or the data they encode.

Check direct generation, streaming, batch submission, queued execution, retries, fallback models, adapter preload/activation, artifact download and job-result retrieval. Some systems bind an authorization lease to a submitted job; others recheck at execution. State which policy applies and how revocation affects queued or running work. An expired browser session does not automatically stop a GPU task, and a valid job identifier does not automatically authorize another caller to read its outputs.

Bind resource identities and tenant context to the actual scheduled operation, including shared-worker state. A cache key or model slot should retain its full canonical owner/version identity, with a separate current permission check before use. Reset or partition request-specific adapter state under the serving implementation. Logical policy checks do not by themselves prove physical side-channel isolation or correct kernel state cleanup; those properties need their own threat model and tests on the selected platform.

Construct two tenants, a shared base model, one private adapter per tenant, and explicit delegated cases. Verify authorized success and denied cross-tenant use for every path, including a warm adapter, an old job handle and a fallback after the preferred model becomes unavailable. Mutate the untrusted tenant field while keeping the authenticated principal fixed. Inspect backend execution and result delivery, not just the response code, to establish that a denial prevented the forbidden action.

The modular lab illustrates why a shared slot number is not a complete resource identity. Reset, set both m=2,a=1, predict residues 0,1,0 at steps zero through two, then take two Steps. Reset and set both m=4,a=1 for 0,1,2. Indices zero and two share slot zero under the first rule but remain different resources. This toy index mapping is not a cryptographic hash, tenant boundary, adapter loader or permission engine; authorization must use full authoritative identities.