Execute tenant-scoped API queries
The agent retrieves specific data records for a single tenant, ensuring strict isolation from other customers' data without needing to write custom filtering logic.
How it works
Read-onlyData and analysis
The agent uses the Aaly MCP server to make authenticated requests to the generated REST endpoints. It queries data (e.g., orders or accounts) for a specific tenant. The platform automatically scopes the request, returning only data belonging to that tenant and returning 403 for cross-tenant access, ensuring security without manual policy implementation.
Prompt
Paste this into an agent that has the servers below connected. Adjust the names and dates to your own.
Prompt for Execute tenant-scoped API queries
Query the Aaly API to retrieve all 'Opportunity' records for the current tenant. Verify that the response only contains data scoped to this specific customer.MCP servers it needs
Source
The vendor page this playbook is drawn from, and the passage that supports it.
Records are scoped to their customer by the platform, on every endpoint, with no opt-in and no policy to author. A cross-tenant read returns 403.Aaly — multi-tenant backend for AI-built apps