Multi-tenant LLM analytics with row-level security: How we built a secure agent on AWS
TL;DR
PAR outlines a production-grade text-to-SQL analytics agent on AWS for restaurant businesses, designed to separate tenants, businesses, admins, and location-level permissions. The system uses three independent layers: AWS SigV4 for signed requests, Amazon Bedrock for semantic validation, and Split-Plane SQL for deterministic row-level data isolation.
Nauti's Take
This is the right direction for AI agents in real data environments: the LLM sits inside a cage of identity, validation, and pre-filtered SQL instead of being pointed directly at the database. The strong part is the separation between security logic and intelligence logic.
The weak part is that this is an AWS blog, not a neutral architecture comparison. Still, the core lesson lands: if a prompt has to enforce your row-level security, you do not really have row-level security.
Briefingshow
Enterprise LLM analytics rarely fails in the demo; it fails around access control, liability, and tenant isolation. The important design choice here is that the model can reason over data, but it does not decide what data exists for the user. That boundary is enforced server-side and deterministically, not as a polite instruction in the prompt.
Sources
