Package com.tnsai.agents.validation.validators

Class TenantScopeValidator

java.lang.Object
com.tnsai.agents.validation.validators.TenantScopeValidator
All Implemented Interfaces:
Validator
public final class TenantScopeValidator extends Object implements Validator
AGENT-V012 — when an agent is configured with AgentBuilder.tenantId(...), every wired component that holds tenant-scoped state must opt into the TenantAware marker SPI. Otherwise the configured isolation promise is a lie: the runtime call site may cross-pollinate data between tenants.

Issue #235 — final phase of the multi-tenant story. Phase 1 shipped the TenantAware marker plus the AgentBuilder.tenantId(...) setter; this validator gives those primitives teeth at build time.

What this validator currently checks

Phase 2 scope: MemoryStore only. Tools and other tenant-aware surfaces are out of scope here — they need additional framework primitives (Tool interface change, audit-event tenant id) that #235's "Required primitives (separate design epic)" callout explicitly defers. Once those land in their own follow-up issues, this validator will gain matching checks.

Behaviour matrix

Outcomes
StateOutcome
No tenantId configured on the builder Silent — single-tenant agents have no isolation requirement to verify
tenantId configured, no MemoryStore explicitly set on the builder WARNING — the build() default InMemoryStore does not implement TenantAware, so a tenant-scoped agent that relies on the default cannot uphold the contract
tenantId configured, store implements TenantAware Silent — store has opted into the contract
tenantId configured, store does NOT implement TenantAware WARNING with the offending store class name and an actionable fix hint

Severity

Emitted as Severity.WARNING under the soft-launch convention shared by V002/V003/V005/V006/V010. The original #85 spec called for ERROR on grounds that data-isolation bugs are worse than performance/UX warnings — that upgrade is reserved for a follow-up PR once consumers have had a release cycle to either implement TenantAware on their stores or suppress with .relaxValidation("AGENT-V012") in environments where they're handling isolation out of band (e.g. one process per tenant).

Since:
0.8.5 (issue #235 phase 2)

  • Constructor Details

    • TenantScopeValidator

      public TenantScopeValidator()

  • Method Details

    • id

      public String id()
      Description copied from interface: Validator
      Short, stable id for logging and test assertions (e.g. "llm-presence").
      Specified by:
      id in interface Validator

    • validate

      public List<ValidationIssue> validate(ValidationContext ctx)
      Description copied from interface: Validator
      Inspect the agent configuration and return any issues detected. Returning an empty list means "no problems found by this validator".
      Specified by:
      validate in interface Validator
      Parameters:
      ctx - frozen view of the agent under construction
      Returns:
      zero-or-more issues; never null