Client Isolation vs Shared Memory for Agency Agent Fleets

At the start of an account team’s workday, a strategist opens Slack and asks an agent to refresh a client’s campaign brief. In this design walkthrough, the artifact is a draft brief inside that client’s workspace. Before retrieval starts, the system must resolve which account the request belongs to and whether the strategist can access it.

The agent may know how Single Grain structures a campaign brief. That does not entitle it to search every account’s research, pricing notes, or performance reports. A missing tenant ID should stop the job, not trigger a broader search. The request can wait. Another client’s documents cannot become fallback context.

Quick Overview

This page is for agency operators building multi-client agent fleets who need shared methods without pooling client memory. The job is to resolve tenant identity and permissions before retrieval or writes, then keep account evidence scoped while skills stay reusable. The mechanism is server-side tenant binding, account-scoped credentials, versioned skill packs without raw client data, and negative isolation tests. The outcome is a fleet that can refresh one account brief safely and reuse the method across clients without cross-tenant fallback.

• Separate reusable skills from client memory; never use another account as fallback context.
• Bind tenant identity server-side; channel names and prompt text are not authorization.
• Recheck permissions on every retrieval, tool call, handoff, and save.
• Publish skill packs without client briefs, metrics, or distinctive strategy residue.
• Name account owner, permission admin, and incident responder separately before expanding the fleet.

Why agency agent fleets need a memory boundary

Build separate boundaries for reusable skills and client memory. A shared skill contains instructions, schemas, and evaluation criteria. Client memory contains account-specific documents, conversations, results, and derived notes. Agents can reuse the first without pooling the second.

In Eric’s Leveling Up discussion of permissions and security, agents can already talk to each other, and team participation through Slack is coming next. Permissions and security are the next big piece. That sequence changes the implementation order: appoint isolation and permission owners before making multiplayer interaction convenient.

For Single Grain’s account workflows, the default should be shared methods with tenant-scoped execution. The campaign-brief skill can be common. The client’s positioning, account history, retrieval index, and working files stay scoped to that account. An agency administrator’s broad access should not become the agent’s default credential.

This also changes the hire-or-build decision for marketing agents. Buy or build around enforceable account boundaries, not the smoothest chat interface. Reject a product that cannot constrain retrieval, tool credentials, and writes independently.

Worked scene: one client request inside an isolated workspace

Return to the strategist’s Slack request. Eric’s recommendation to give an agent a real business task becomes a bounded assignment: refresh this account’s campaign brief using its current positioning document and approved performance export. Success means a useful draft with traceable sources, saved only to the account’s designated draft folder.

The Slack integration authenticates the requester. A trusted account mapping supplies the tenant ID and approved workspace. A channel name alone is insufficient because channels can be renamed and users can participate across accounts. The authorization service checks the requester’s membership before issuing a job-scoped capability.

The retrieval agent receives that capability and searches only the account’s permitted collection. A drafting agent can receive the resulting evidence, but the handoff retains the same tenant scope. This is the practical consequence of Eric’s multiplayer observation: agent-to-agent communication and Slack participation require scoped retrieval and an audit trail, not open shared memory.

Pinecone’s multitenancy guide recommends one namespace per tenant and requires every upsert, query, update, and delete to target that namespace; it calls metadata-only filtering in a shared namespace a poor fit for strict isolation. Weaviate’s multitenancy documentation likewise uses separate tenant shards and requires tenant-scoped CRUD and search. Treat tenant selection as a storage-layer invariant, not a prompt instruction.

Eric’s point that AI tasks rarely end with one answer adds another requirement: authorization must survive every step. Recheck permissions when fetching a source, calling a tool, delegating work, and saving the artifact. A valid first request does not authorize a later destination change.

If retrieval returns insufficient evidence, the agent reports the gap. It does not search neighboring accounts. If a tool proposes a different tenant’s folder, the write is denied and logged. These are required behaviors for the walkthrough, not claims about an observed leakage incident.

OWASP’s LLM Top 10 elevates sensitive information disclosure and excessive agency as core application risks for retrieval and tool use. Pair that with NIST AI RMF accountability: name the boundary owner, map which account data the job may touch, measure isolation with negative tests (forged tenant IDs, cross-account document IDs, destination switches), and manage failures with revocation. A prompt that says “stay in this account” is not an access-control system.

Worked scene: share a skill without sharing raw client memory

The second job is to make the campaign-brief method reusable. An operations lead takes the brief’s structure, required inputs, source-citation rules, and quality rubric into a versioned skill package. The package explains how to synthesize positioning and performance evidence. It contains no client brief, account metrics, Slack excerpts, or retrieval results.

Do not treat removing a client name as sufficient sanitization. Distinctive pricing, launch dates, audience descriptions, and strategy can still identify an account. Write the reusable instructions deliberately and test them with synthetic fixtures rather than copying a successful account conversation into the shared library.

Anthropic’s effective-agents guidance favors simple, composable workflows. Prefer a versioned skill pack plus constrained retrieval over an autonomous memory-sharing layer that can pull another tenant’s notes. Shared methods are allowed. Shared raw client memory is not.

The operations lead publishes the skill through a separate maintenance identity. Account execution agents receive read access to approved versions, not permission to rewrite the agency library. Each account loads the same method, supplies its own authorized inputs, and stores its outputs locally. An account-derived improvement can become a proposed change, but cannot silently become global memory.

Anthropic’s guidance on effective agents favors simple, composable workflows. Apply that principle here: a versioned skill and constrained retrieval often provide enough reuse without an autonomous memory-sharing system. Single Grain’s approach to specialized marketing LLMs for pipeline jobs should preserve that separation between job expertise and account evidence.

Governance also needs explicit coverage. The NIST AI RMF 1.0 Core organizes its four functions into six Govern categories, five Map categories, four Measure categories, and four Manage categories. These are framework counts, not security scores or measured agency outcomes.

Use those functions to divide responsibility: assign the boundary owner, map account data flows, measure isolation with negative tests, and manage failures through revocation and rollback. The chart is a planning aid, not evidence that checking boxes makes a fleet secure.

Isolation and permission checklist

Eric’s emphasis that people still matter for taste, review, and workflow management determines the delivery gate. Record the assigned account owner’s name in the job configuration. That person verifies source provenance, account scope, and brief quality before client delivery. The agent writes a draft; it does not autopublish.

Use the following controls as acceptance criteria before expanding the fleet:

• Bind tenant identity server-side. Do not let prompt text select or override authorization scope.
• Enforce retrieval boundaries in the storage or access layer. A prompt telling the model to stay inside an account is insufficient.
• Scope caches, conversation history, embeddings, temporary files, and derived summaries, not just original documents.
• Give tools account-specific credentials and destination allowlists. Never grant fleet-wide cross-tenant write access.
• Log requester identity, tenant, skill version, retrieved source IDs, tool actions, and output destination. Restrict the logs themselves.
• Test unauthorized document IDs, forged tenant arguments, destination changes, and instructions embedded in retrieved content.
• Define revocation and retention behavior for account offboarding, including backups and derived memory.

The OWASP LLM Top 10 identifies sensitive information disclosure, excessive agency, and vector and embedding weaknesses as relevant risks. Use them to shape adversarial tests rather than claiming a tenant filter solves every exposure path.

Single Grain’s marketing-agent RACI should name the account owner, permission administrator, and incident responder separately. Pair that ownership with SLAs and kill switches that can suspend one account’s tools without unnecessarily stopping every account.

Single Brain installs the system; Single Grain runs it when you need the team

Single Brain is the AI implementation OS for agents, eval, and kill switches. For a multi-client fleet, the installation should establish tenant-bound workspaces, reusable skill versions, scoped credentials, isolation evaluations, and account-level shutdown controls. The handover artifact should show who can retrieve, execute, and write in each workspace.

Do not buy a fleet when an occasional brief can be handled with a controlled manual workflow. Do not automate a task whose account scope cannot be resolved reliably. Refuse write access when a connector cannot enforce destination boundaries. Start read-only or choose a different tool.

If the work justifies automation but you do not want to staff implementation and ongoing operations, hire Single Grain to install and run the system. Start with one bounded account job, prove the isolation controls, and then reuse the skill across clients without sharing their raw memory.