AI agents data security LLM analytics multi-tenant AWS

Securing AI analytics: Why trusting your AI agent with data access is a mistake

Corteus Team · Jun 29, 2026 · 9 min read

Discover how a three-layer security architecture prevents data leaks in multi-tenant AI analytics systems, protecting sensitive business information for over 300 restaurant brands.

If you’ve used ChatGPT, you know it types an answer back. You ask it a question, and it gives you words. It’s like talking to a very smart friend who only communicates by writing.

But a newer kind of AI doesn’t just talk. It does things. This is what people mean by an AI agent (an AI program that can take actions, not just generate text). It can use tools, connect to other systems, and actually get work done. Imagine an AI that doesn’t just tell you the sales figures but can also pull the latest report from your CRM and then draft an email summarizing it. That’s an agent at work.

This is powerful stuff for business. It promises self-serve analytics, automated workflows, and faster decisions. But here’s the thing: when AI agents start interacting with your actual business data, especially sensitive data, you run into some serious security questions.

Why your AI might show the wrong numbers to the right people

Consider a common scenario for a company that supports many customers using one system, a setup called multi-tenant (meaning one system serves many separate businesses, each with their own data). Imagine a company like PAR Technology, which builds software for over 300 different restaurant businesses.

Now, picture two different users logging into an AI analytics agent at that company, both asking the same question: “What were total sales last week?”

One user is a franchise owner. She operates two locations in Chicago. For her, the correct answer is $84,000, representing the combined sales of her two stores. The other user is a brand manager at the corporate level. He oversees the entire chain, perhaps 200 locations across the country. For him, the correct answer is $9.2 million.

Same question. Same underlying database. Completely different numbers, and both are absolutely correct for their respective roles.

Showing the franchise owner the national figure isn’t just a data governance failure. It potentially exposes commercially sensitive information about other operators on the system. And showing the brand manager only two locations’ worth of data means he’s making national decisions on incomplete information. This is the row-level security problem (restricting which specific data rows a user can see). Every query has to return the right number for that specific user, not the global number, not another tenant’s number.

Why you can’t just tell the AI to be careful

At first, this seems like an easy fix. You might think, “Just tell the AI which user is asking the question. Include the user’s business ID in the prompt, tell the model to consistently scope queries accordingly, and trust it to comply.”

This confused me for years. It seems logical, right? We assume the AI, being so smart, will just follow instructions. But here’s the problem: Large Language Models (LLMs) (the underlying brain of ChatGPT and these agents) are non-deterministic by nature. That’s a fancy way of saying they don’t always give the exact same output for the exact same input. They are probabilistic generators, meaning they predict the most likely next word or action, rather than following rigid rules.

A model that correctly applies a business ID filter 9,999 times might silently omit it on the 10,000th time. It might hallucinate (make up) a filter value. It could misinterpret an ambiguous prompt and broaden the scope of a query in ways that expose data it shouldn’t touch. In a consumer chatbot, this non-determinism is an inconvenience. But in a multi-tenant analytics system handling sensitive business data, it’s a gaping security hole. You simply cannot build a compliance posture on top of a system that might behave differently every time.

The real answer: Layers of security, like a bank vault

To build a secure AI analytics agent, you need to design security directly into the architecture, independent of the AI model. Think of it like a bank vault. You don’t just have one lock. You have multiple layers: a heavy door, a combination lock, a key, security cameras, maybe even a guard. If one layer fails, others are still there to protect the assets.

The company in our example, PAR Technology, built a system with three independent security layers, ensuring data boundaries are enforced deterministically, regardless of what the LLM does or doesn’t do.

Here’s how it generally works:

The Entry Check (Cryptographic Request Signing): When a user asks a question, the system first adds a digital signature to the request. This is like putting a tamper-proof seal on an envelope. It uses something like AWS SigV4 (a standard for cryptographically signing AWS API requests) to prove who sent the request and that it hasn’t been changed along the way. If the signature doesn’t match, or if someone tried to mess with the request, it gets rejected immediately. This is the first bouncer at the door, checking your ID.
The Rulebook Check (Semantic Validation): After the request is verified as legitimate, it goes to a security layer that checks what the meaning of the request is, not just its wording. The AI agent generates a potential SQL query (the language databases understand) based on the user’s question. Before this query ever touches the actual database, the system performs semantic validation (checking the meaning of the query against a set of security rules). It asks: “Does this query, even if the AI generated it, conform to the user’s allowed data access rules?” If the AI accidentally generated a query asking for national sales when the user is only allowed to see two stores, this layer catches it. This is like a security guard carefully reviewing your paperwork against a strict rulebook.
The Hard Barrier (Programmatic Data Isolation): Even if the first two layers somehow failed, this final layer creates an unbreakable barrier. It’s called programmatic data isolation (enforcing data access rules directly through code and database design). The database itself is designed to only show a user the data they are authorized to see. One common technique for this is called Split-Plane SQL, where the system injects the user’s specific access filters (like “Business ID = ‘franchise_chicago’”) directly into the SQL query before it even reaches the main database. This means no matter what the AI model asks for, the database will only return rows that match the user’s permissions. This is like having separate, locked safes for each customer’s money, even if they’re all in the same vault. Your money literally cannot mix with anyone else’s.

*This three-layer architecture ensures that user requests are verified, queries are validated for meaning, and data access is strictly enforced at the database level.*

Why this matters to you

For CEOs, CFOs, and investors, this isn’t just technical jargon. It’s about protecting your business.

First, it’s about compliance. Data privacy regulations like GDPR or CCPA demand strict controls over who sees what data. Relying on an AI that might occasionally slip up is a non-starter. This layered approach provides deterministic controls your compliance team can actually stand behind.

Second, it’s about trust. If your internal teams or customers lose trust in your AI systems because of data exposure, adoption will plummet. This architecture builds confidence that the insights provided by AI are not only accurate but also secure.

Third, it’s about risk mitigation. A single data breach from an AI agent misinterpreting a query could be catastrophic. The financial, reputational, and legal costs can be staggering. Building in these layers of security drastically reduces that risk. For example, the PAR Technology system uses Amazon Bedrock (an AWS service for building with LLMs) to handle the AI part, but the critical security decisions happen outside the LLM itself, ensuring that even if the model were somehow compromised or manipulated, the data remains safe.

The engineering effort is real, but necessary

Building such a system isn’t trivial. It takes significant engineering effort and a deep understanding of security principles. The team at PAR Technology, for instance, had to move from a simpler initial version (which used Anthropic’s Claude Sonnet 4 model, released in 2023) to this more complex, three-layered architecture specifically because they understood the vulnerabilities of trusting the AI model alone. Their initial setup, while analytically promising, was architecturally vulnerable for an enterprise, multi-tenant environment where data boundaries are a compliance requirement.

Honestly, most companies adopting AI are doing it wrong, at least initially. They start with the cool AI capabilities, then try to bolt on security. The lesson here is that for sensitive applications, security needs to be designed in from the ground up.

It means investing in the right talent and architectural planning upfront. But the alternative – a data breach or loss of trust – is far more costly in the long run. When AI agents start doing things with your data, you need to be sure they’re doing the right things, and only the right things, every single time. And for that, you can’t just ask the AI to be careful. You need to build a fortress around it.

Sources: aws.amazon.com

Frequently asked questions

What is an AI agent?

An AI agent is an artificial intelligence program that can perform specific actions or tasks, often by using tools, instead of just generating text like a chatbot. It acts like a digital assistant that can 'do' things for you.

What does multi-tenant mean?

Multi-tenant means a single software system serves multiple separate customers or 'tenants,' each with their own isolated data and configurations. Think of an apartment building where everyone shares the infrastructure but has their own private apartment.

What is row-level security?

Row-level security is a database feature that restricts which rows of data a specific user can see or interact with. It ensures that different users querying the same database get tailored results based on their permissions, preventing unauthorized data access.

Why can't I trust an LLM for security?

Large Language Models (LLMs) are inherently non-deterministic, meaning they don't always produce the exact same output for the same input. This probabilistic nature makes them unreliable for critical security enforcement, as they might occasionally 'forget' rules or 'hallucinate' incorrect data filters.

What are the three layers of security mentioned?

The three layers are cryptographic request signing, semantic validation, and programmatic data isolation. These layers work together to create a robust security perimeter around sensitive data accessed by AI agents.

What is cryptographic request signing?

Cryptographic request signing is a digital security technique that adds a unique, verifiable signature to every request. This ensures that the request truly came from an authorized source and hasn't been tampered with during transit.

What is semantic validation in AI?

Semantic validation involves checking the *meaning* and intent of an AI agent's generated query against a set of predefined security rules. It ensures the query's purpose aligns with what the user is allowed to ask, even if the phrasing is unusual.

What is programmatic data isolation?

Programmatic data isolation means enforcing data access rules directly through code and database design, separate from the AI model itself. This creates a hard, deterministic boundary around data, ensuring users only access their authorized information.

Is this approach expensive to build?

Implementing a multi-layered security architecture for AI analytics can require significant engineering effort and specialized expertise. However, the cost of a data breach or compliance failure often far outweighs these upfront development expenses.

What are the benefits for a business?

Businesses gain peace of mind from enhanced data security, reduced risk of compliance violations, and the ability to confidently deploy AI analytics across diverse user groups. It ensures data integrity and fosters trust in AI-driven insights.

Related writing

Jun 29, 2026

Get a build memo.

Send us your thesis. A senior engineering team sends back a written assessment — architecture, cost to first production deploy, and the risks most likely to kill it. Five business days.

Request a build memo