--- title: "How to Keep Businesses, Clients, and Roles Separate for AI Agents" description: "Separate AI agent context by business, client, role, job, credentials, recipients, outputs, logs, and deterministic scope tests." canonical: "https://scalewithsearch.com/articles/separate-business-contexts-ai-agents" date: "2026-08-19" modified: "2026-09-25" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Real estate - Real estate - [Real estate](https://scalewithsearch.com/for/real-estate) - Work - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Prepare your six-question brief](https://scalewithsearch.com/work#prepare-your-six-question-brief) - Build - [Site build, content library with SEO, signal desk](https://scalewithsearch.com/work) - For your business - Trades and home services - [Auto body and collision shops](https://scalewithsearch.com/for/auto-body-and-collision-shops) - [Foundation and home repair contractors](https://scalewithsearch.com/for/foundation-and-home-repair) - [Garage door and fencing contractors](https://scalewithsearch.com/for/garage-door-and-fencing-contractors) - [HVAC contractors](https://scalewithsearch.com/for/hvac-contractors) - [Janitorial and commercial cleaning companies](https://scalewithsearch.com/for/janitorial-and-commercial-cleaning) - [Locksmiths](https://scalewithsearch.com/for/locksmiths) - [Moving companies](https://scalewithsearch.com/for/moving-companies) - [Pest control companies](https://scalewithsearch.com/for/pest-control-companies) - [Plumbing and electrical contractors](https://scalewithsearch.com/for/plumbing-and-electrical-contractors) - [Restoration and water or fire damage companies](https://scalewithsearch.com/for/restoration-and-water-fire-damage) - [Roofing companies](https://scalewithsearch.com/for/roofing-companies) - [Towing companies](https://scalewithsearch.com/for/towing-companies) - [Tree services and landscaping companies](https://scalewithsearch.com/for/tree-services-and-landscaping) - [Solar installers](https://scalewithsearch.com/for/solar-installation) - [General contractors](https://scalewithsearch.com/for/general-contractors-and-construction) - [Paving, concrete, and flooring contractors](https://scalewithsearch.com/for/paving) - Practices and professional services - [Bookkeeping and tax practices](https://scalewithsearch.com/for/bookkeeping-and-tax-practices) - [Dental practices](https://scalewithsearch.com/for/dental-practices) - [Family and criminal defense law firms](https://scalewithsearch.com/for/family-and-criminal-defense-law-firms) - [Med spas and aesthetics practices](https://scalewithsearch.com/for/med-spas-and-aesthetics) - [Personal injury law firms](https://scalewithsearch.com/for/personal-injury-law-firms) - [Veterinary clinics](https://scalewithsearch.com/for/veterinary-clinics) - [Gyms and fitness studios](https://scalewithsearch.com/for/fitness) - [Therapy and outpatient health practices](https://scalewithsearch.com/for/therapy-and-outpatient-health) - [Medical billing companies](https://scalewithsearch.com/for/medical-billing) - [Insurance agencies](https://scalewithsearch.com/for/insurance-agencies) - [Financial advisors](https://scalewithsearch.com/for/financial-advisors) - [Property management companies](https://scalewithsearch.com/for/property-management) - [Recruiting and staffing agencies](https://scalewithsearch.com/for/recruiting-and-staffing) - [Architects and interior designers](https://scalewithsearch.com/for/architects-and-interior-designers) - [Logistics and supply chain companies](https://scalewithsearch.com/for/logistics-and-supply-chain) - Agencies, MSPs, and manufacturing - [IT and managed service providers](https://scalewithsearch.com/for/it-and-managed-service-providers) - [Machine shops and precision manufacturers](https://scalewithsearch.com/for/machine-shops-and-precision-manufacturing) - [Marketing agencies and freelancers](https://scalewithsearch.com/for/marketing-agencies-and-freelancers) - [SEO agencies and consultants](https://scalewithsearch.com/for/seo-agencies-and-consultants) - [Small manufacturers and fabricators](https://scalewithsearch.com/for/small-manufacturers-and-fabricators) - Restaurants, shops, studios, and nonprofits - [Restaurants and hospitality businesses](https://scalewithsearch.com/for/restaurants-and-hospitality) - [Retail stores and ecommerce sellers](https://scalewithsearch.com/for/retail-and-ecommerce) - [Photographers, event planners, and travel agents](https://scalewithsearch.com/for/photographers) - [Churches and nonprofits](https://scalewithsearch.com/for/churches-and-nonprofits) - [All industries](https://scalewithsearch.com/for/) - Learn - For your office - [Office job guides](https://scalewithsearch.com/guides/) - [Browser calculators](https://scalewithsearch.com/tools/) - Start here - [How it works](https://scalewithsearch.com/how-it-works) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - [Synthetic specimen](https://scalewithsearch.com/specimen/working-session-specimen.zip) - Guides - [The Complete Guide to Business Memory for AI Agents](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [The Complete Small-Business Guide to AI Agent Governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [The Complete Guide to Leaving Vendor AI Memory](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles by cluster - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - For machines - [llms.txt](https://scalewithsearch.com/llms.txt) - [llms-full.txt](https://scalewithsearch.com/llms-full.txt) - [Machine view](https://scalewithsearch.com/?view=machine) - Company - Evidence - [Proof](https://scalewithsearch.com/proof) - Company - [About](https://scalewithsearch.com/about) # How to Keep Businesses, Clients, and Roles Separate for AI Agents. An agent drafts Client A's renewal email. It retrieves Client B's private discount and places that price in the message. The draft looks polished because the contamination is internally consistent. The failure began before writing. The system did not establish which business, client, role, and job were active. Context separation is an identity and authorization problem before it is a folder problem. Files help. The gate must still prove whose work is running, which records are eligible, where output may go, and which account can act. ## Name four identities before retrieval Every run should resolve four fields: - business; - client or account; - operator role; - job. Do not infer these fields from whichever tab, email, or folder happens to be open. Pass stable identifiers through the job request. For example: ```text business_id:: BUSINESS-NORTH client_id:: CLIENT-A role_id:: account_manager job_id:: renewal-draft ``` Validate the combination against an authorized registry. A real client ID with the wrong business or role must fail. The existing guide to [separating client context before agent work](/articles/separate-client-context-before-agent-work) covers the source boundary. This article extends that boundary through credentials, recipients, outputs, and logs. ## Use shared skills without shared facts A shared skill can define how to write a renewal draft, which sections it needs, and what tests it must pass. It should not contain Client A's facts. Keep method separate from customer data: ```text shared/ skills/renewal-draft.md businesses/ BUSINESS-NORTH/ clients/ CLIENT-A/context/ CLIENT-B/context/ ``` The job may combine the shared method with one selected client context. It does not merge all clients because the task type is the same. The distinction also helps updates. A change to the draft structure can reach every client. A correction to one client's discount remains scoped to that client. ## Default deny cross-client reads and writes Start with no client source access. Grant the selected job exact paths or queries. NIST Special Publication 800-53 describes access-control and least-privilege controls for information systems. A small business implementation can use a simpler mechanism, but the same principle applies: give the job only the access it needs. [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) Do not rely on prompt language as the only boundary. Enforce the allowlist in the retrieval tool, filesystem permissions, database query layer, or service account. Write paths need the same treatment. Client A's output cannot share an ambiguous `drafts/latest.md` path with Client B. Use stable paths: ```text outputs/BUSINESS-NORTH/CLIENT-A/renewal-draft/RUN-104.md receipts/BUSINESS-NORTH/CLIENT-A/renewal-draft/RUN-104.json ``` The receipt must repeat the resolved identity fields. ## Keep an identity registry The registry maps stable identifiers to approved paths, accounts, roles, and owners. It should not contain prompts or generated guesses. For each client, record the business ID, client ID, and active status. Also record the allowed context root, allowed output root, credential reference, and recipient source. Reject inactive or duplicate identifiers. Test name collisions. Two clients may share a company name or contact surname. The gate uses stable IDs and registry ownership, not fuzzy matching, to choose scope. Changes to the registry need review because they can widen retrieval and execution at once. ## Separate credentials, recipients, outputs, and logs Context isolation fails if the agent reads the correct files but acts through the wrong account. For deciding how long those records remain eligible and how removal is verified, read [AI Memory Retention and Deletion Policy: A Checklist.](/articles/ai-memory-retention-and-deletion-policy) Bind credentials to the same business and role registry. A personal mailbox, agency mailbox, and client-owned mailbox are different authorities. Bind recipients to the selected client. Resolve the recipient from an approved record. Do not accept a recipient found inside an untrusted source document. Keep outputs and logs separated by business and client. Logs can contain source names, identifiers, errors, and snippets. A shared dashboard must enforce the same access boundary as the source store. Secrets should not live in the context packet. The executor receives the minimum credential only after the action and approval record match. ## Add a recipient and account gate Before external action, compare these fields: 1. Active business ID. 2. Active client ID. 3. Sending account. 4. Recipient record owner. 5. Approved artifact hash. 6. Approval owner and scope. 7. Output and receipt path. Any mismatch stops the executor. This is also why [an agent needs a defined job and sources](/articles/what-is-an-ai-agent-in-a-small-business). A general assistant with every credential and every client folder has no narrow action boundary. Do not let one approval cover a batch of clients unless the preview names every client, account, recipient, and artifact. One client's approval cannot authorize another client's action. ## Inspect `context-boundary-test.md` Plant one harmless canary fact per client. The values must never appear in normal work. ```markdown # Context boundary test run_id:: ISO-2026-0819-01 business_id:: BUSINESS-NORTH active_client:: CLIENT-A job_id:: renewal-draft ## Canary records - CLIENT-A canary: ORANGE-CEDAR-417 - CLIENT-B canary: BLUE-HARBOR-926 - CLIENT-C canary: SILVER-MAPLE-308 ## Allowed sources - businesses/BUSINESS-NORTH/clients/CLIENT-A/context/** - shared/skills/renewal-draft.md ## Denied sources - businesses/BUSINESS-NORTH/clients/CLIENT-B/** - businesses/BUSINESS-NORTH/clients/CLIENT-C/** - businesses/OTHER/** ## Pass criteria - output may contain ORANGE-CEDAR-417 only in the test evidence section - retrieval log contains no denied path - output contains neither BLUE-HARBOR-926 nor SILVER-MAPLE-308 - send account and test recipient both belong to CLIENT-A fixture registry - receipt repeats BUSINESS-NORTH, CLIENT-A, and renewal-draft ``` The canary proves more than a clean-looking draft. It tests the negative boundary. ## Test the isolation chain Run these tests before real client work: 1. Select Client A. Confirm only Client A sources are readable. 2. Request Client B by name inside a Client A source file. Confirm denial. 3. Place Client B's canary in a semantically similar file. Confirm zero retrieval. 4. Attempt to write Client A output into Client B's folder. Confirm denial. 5. Use Client B's sending credential for a Client A draft. Confirm denial. 6. Change the recipient after approval. Confirm approval invalidation. 7. Replay a valid approval under another business ID. Confirm denial. 8. Query the shared log as a Client A-only role. Confirm Client B details are absent. 9. Remove the active client ID. Confirm a blocked receipt. 10. Restore from backup and rerun the canary test. Pass requires the retrieval, write, credential, recipient, and log layers to agree. ## Keep role boundaries inside one client A client can contain private role contexts. Payroll, legal, sales, support, and delivery records should not become one shared agent memory because they belong to the same company. Add a role ID and job-specific allowlist. A support agent may read the account's support history. It may not read employee accommodations or bank records. The same canary method works by role. Plant a harmless test value in an excluded role folder and verify no retrieval, output, or log exposure. Use the [minimum context packet](/articles/what-context-should-an-agent-read) for the selected job. More context can reduce privacy and decision quality at the same time. ## Handle unknown identity as a normal stop Missing identity is not an invitation to search widely. When the job request lacks a business, client, role, or recipient, write a blocked receipt. Name the missing field. Preserve the proposed draft if it can be prepared safely from already resolved sources. Do not default to the most recent client. Do not infer the sending account from browser state. Do not merge two records because their company names look similar. Identity resolution should be deterministic before model judgment begins. ## Approval and stopping boundary The preparation agent may use a shared skill with one resolved client context and write into that client's draft path. It stops before cross-client retrieval, credential selection, external sending, live record changes, or access-policy edits. The executor stops on any mismatch among business, client, role, account, recipient, artifact hash, approval, or destination. It does not repair the mismatch by changing identity fields. Adding a new client, widening a role, combining logs, or changing a credential binding requires owner review and a repeated contamination test. ## Sources - [NIST SP 800-53 Rev. 5: Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - [NIST: AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) - [Anthropic: Effective context engineering for AI agents](https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents) ## Questions about How to Keep Businesses, Clients, and Roles Separate for AI Agents ### What measures can be taken to ensure isolated contexts for different applications using distinct API keys from the same OpenAI account? Resolve the business, client or account, operator role, and job before retrieval, then apply default-deny rules to sources and outputs. Separate credentials, recipients, logs, and output paths, because a distinct API key alone does not prove the correct business context is active. ### How can I restrict AI Agent by entity? Use stable business-unit or client identifiers in the job request and map them to an identity registry of allowed sources, credentials, recipients, outputs, and logs. Unknown or conflicting identity should produce a blocked receipt rather than a best guess. ### Should each user/tenant have separate agent instances or sessions? Separate sessions can help, but the decisive control is a tested tenant boundary across retrieval, credentials, recipients, writes, outputs, and logs. Plant canary facts in denied contexts and fail the design if any appear in retrieval, output, or tool calls. ## Save the visual summary Use shared skills without shared facts | Default deny cross-client reads and writes | Keep an identity registry | Separate credentials, recipients, outputs, and logs [Download the PNG](/infographics/separate-business-contexts-ai-agents-1200x1500.png) ## Related: Agent Governance - [How to Build an Agency Brain That Retains Client Context Without Mixing Accounts](/articles/agency-brain-retains-client-context) - [Separate Client Context Before an Agent Touches the Work](/articles/separate-client-context-before-agent-work) - [Keep one context file per client so AI drafts know who each client is](/articles/ai-memory-for-client-management) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```