TenantInvariant library introduced to secure AI tool calls

A new experimental Rust crate, TenantInvariant, has been introduced to address security vulnerabilities in AI-enabled SaaS products. The library aims to prevent unauthorized data access during AI tool calls, specifically targeting scenarios where an AI agent might mistakenly request a resource ID belonging to a different tenant.

Because prompts cannot serve as reliable authorization boundaries, TenantInvariant functions by having the server resolve resource ownership from a trusted source. It then compares the authenticated actor against the owner to ensure tenant isolation is maintained before any tool execution occurs. The library is designed to fail closed in cases of cross-tenant access or unknown ownership.