Single-user tests are reassuring. They are also a poor way to find a response delivered to the wrong user.
Agent platforms retain conversation history, tool results, background tasks, memory, cached credentials, and resume state. A leak can happen long after the original request was authenticated.
Prepare two clients and two canaries
Create clients A and B with separate authorized identities. Give each a different harmless marker in its data. Use one shared server process, store, and cache, matching the deployment you intend to run.
Now deliberately reuse request IDs and task names. A robust implementation cannot depend on every client choosing globally unique identifiers.
The following test outline is illustrative:
A creates task "report" with request ID 7
B creates task "report" with request ID 7
A disconnects before its result is delivered
B requests a task list and cached results
A reconnects through a different worker
B attempts to read or cancel A's task
assert each client receives only authorized state
Add transitions that lose request context
Repeat with timeouts, retry queues, notifications, and cancellation racing with completion. Background workers often run after the initiating HTTP context is gone.
Check errors as well as successful results. A denied lookup can still reveal the other user's title, arguments, or partial response. A cancellation can return an error while modifying the wrong task.
The MCP task-store issue, cross-client response issue, and DeepSeek MCP exposure are useful references for the kinds of ownership boundary these tests should exercise.
Inspect three evidence streams
Watch client-visible output, stored objects, and delivery records. A task can remain correctly owned in the database while a notification router sends its result to the wrong connection.
Include log and analytics views in the test. Operators may have broader access by design, but customer-facing dashboards must not reveal another tenant's content through a separate reporting path.
For resumption, define which identity may recover old state and how an authorized transfer works. Possession of a task ID or session ID alone should not determine access.
Turn a failure into a regression case
Save the smallest reproducible event sequence, the expected owner, and the component that lost that context. Avoid recording sensitive production content.
Then test the fix under the same shared-process conditions. Spinning up an isolated server for every test can hide the exact reuse that caused the failure.
The session-isolation design note provides the storage invariant behind these tests. This notebook checks whether the complete runtime preserves it.