Architecting Multi-User Agentic Systems

Security at the Action Boundary

Traditional LLM security fails in agentic systems because agents interact with external tools, creating a vast attack surface. Research indicates that individual benign skills can collide to create malignant outcomes, such as an OCR module and a reporting module colluding to leak PII. Instead of filtering inputs, which is prone to failure against obfuscated attacks like dot-interspersed text (e.g., "d.o.t"), developers should implement deterministic guards at the action surface. This involves monitoring bash variables, file exports, and secret configurations. For advanced protection, fine-tune a small language model (SLM) with LoRA adapters to separate instruction channels from data channels, allowing the agent to perform tasks while blocking malicious payloads.

Dynamic Memory and Privacy

Group-based agents face context bloat and privacy challenges that single-user agents do not. To manage memory, move away from storing raw conversation history toward extracting atomic, hierarchical facts. Implement a continuous relevance scorer to determine what information to retain and what to forget, which optimizes token usage and context relevance. To handle privacy in shared environments, avoid hard-coded permission logic. Instead, utilize a shared memory layer combined with per-user LoRA adapters to bake permissions directly into the model's response generation. Finally, use a classifier to govern agent verbosity, ensuring the agent only speaks when the context or user role necessitates it, rather than defaulting to over-articulation.