# IAM-08 Multi-tenant credential isolation

Domain: IAM Identity, Access & Authorization · HI-AAF v1.3 · Public review · https://humanintel.net/standard/iam/iam-08

In multi-tenant deployments, tenant-bound credentials and authorization are enforced at the runtime layer, not solely in application logic.

For multi-tenant agent deployments, credential isolation between tenants is enforced at the runtime layer, the infrastructure itself prevents cross-tenant credential use, rather than relying solely on application-level logic checks. This defense-in-depth approach ensures that a bug in application code cannot result in one tenant's agent operating with another tenant's credentials or authorization scope.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for IAM-08: Tenant-bound credential isolation is enforced at the runtime layer; automated tests verify that cross-tenant credential use is blocked; isolation failures are treated as incidents under MON-07.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Tenant-bound credential isolation is enforced at the runtime layer.
- Automated tests verify that cross-tenant credential use is blocked.
- Isolation failures are treated as incidents under MON-07.

## Framework mappings

- ISO/IEC 42001: A.7.4
- SOC 2 (TSC): CC6.1, CC6.3
- EU AI Act: Art. 15(2)
- Singapore: PDPA s.24, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites MON-07 Agent-specific incident response: https://humanintel.net/standard/mon/mon-07
- Cited by DAT-02 Cross-tenant data isolation: https://humanintel.net/standard/dat/dat-02

## Cite this control

Human Intelligence. HI-AAF v1.3, IAM-08 Multi-tenant credential isolation. Public review edition, July 2026. https://humanintel.net/standard/iam/iam-08