The agent retrieves specific data records for a single tenant, ensuring strict isolation from other customers' data without needing to write custom filtering logic.
The agent uses the Aaly MCP server to make authenticated requests to the generated REST endpoints. It queries data (e.g., orders or accounts) for a specific tenant. The platform automatically scopes the request, returning only data belonging to that tenant and returning 403 for cross-tenant access, ensuring security without manual policy implementation.
- Category: Data and analysis
- Effect: Read-only
- MCP servers: Aaly MCP (https://koskamo.com/explore/aaly-mcp)
- Source: Aaly — multi-tenant backend for AI-built apps (https://aaly.io/)
- Source quote: "Records are scoped to their customer by the platform, on every endpoint, with no opt-in and no policy to author. A cross-tenant read returns 403."
- Playbook page: https://koskamo.com/explore/use-cases/execute-tenant-scoped-api-queries
Prompt: Query the Aaly API to retrieve all 'Opportunity' records for the current tenant. Verify that the response only contains data scoped to this specific customer.