Trust-Aware Orchestration Architecture for LLM-Assisted Workflows in Multi-Tenant Enterprise Systems
Large language models (LLMs) now call tools and APIs in enterprise systems, creating concrete risks: hallucinated parameters, cross-tenant data leakage, and prompt injection. This paper presents an orchestration architecture for multi-tenant deployments where the LLM proposes actions and a deterministic control plane validates and executes them, organized as three hard enforcement gates (authentication and tenant resolution, role-based tool authorization, and schema validation), four advisory filters (input sanitization, retrieval scoping, execution monitoring, output compliance), and append-only audit logging. The hard gates provide three structural guarantees (tenant isolation, tool-allowlist enforcement, schema conformance) specified as deterministic predicates and verified at the logical control-plane level; they do not defend against within-scope intent manipulation, in which an authorized role invokes an authorized tool with schema-valid parameters for a malicious purpose. A 20-prompt adaptive case study shows within-scope attacks succeed on every one of five LLMs tested, at point-estimate rates of 30%–70%, including the three frontier Claude models (Haiku 4.5, Sonnet 4, Opus 4.6). The structural guarantees hold uniformly across 14,885 evaluations: 1,497 custom prompts plus adversarial prompts from two established benchmarks (683 TensorTrust and 777 AgentDojo across three domains and three attack strategies) and a 20-prompt adaptive case study. Targeted attack-success rate on AgentDojo is $\leq 1.9\%$ across all five models, comparable to published defended baselines. Deterministic syntax recovery reduces the 3B model’s false rejection rate from 52% to 15.2% at zero latency cost; frontier models achieve 0%. Input sanitization flagged injection patterns in only 10.2% of injection prompts without solo-rejecting any, confirming pattern-based detection is insufficient. Within-scope intent manipulation remains an open problem the hard gates do not address. The architecture targets enterprise systems requiring explainability, safety, and regulatory compliance.
Paper
Full text
Trust-Aware Orchestration Architecture for LLM-Assisted Workflows in Multi-Tenant Enterprise Systems
Semantic Scholar · 2026
Abstract
Large language models (LLMs) now call tools and APIs in enterprise systems, creating concrete risks: hallucinated parameters, cross-tenant data leakage, and prompt injection. This paper presents an orchestration architecture for multi-tenant deployments where the LLM proposes actions and a deterministic control plane validates and executes them, organized as three hard enforcement gates (authentication and tenant resolution, role-based tool authorization, and schema validation), four advisory filters (input sanitization, retrieval scoping, execution monitoring, output compliance), and append-only audit logging. The hard gates provide three structural guarantees (tenant isolation, tool-allowlist enforcement, schema conformance) specified as deterministic predicates and verified at the logical control-plane level; they do not defend against within-scope intent manipulation, in which an authorized role invokes an authorized tool with schema-valid parameters for a malicious purpose. A 20-prompt adaptive case study shows within-scope attacks succeed on every one of five LLMs tested, at point-estimate rates of 30%–70%, including the three frontier Claude models (Haiku 4.5, Sonnet 4, Opus 4.6). The structural guarantees hold uniformly across 14,885 evaluations: 1,497 custom prompts plus adversarial prompts from two established benchmarks (683 TensorTrust and 777 AgentDojo across three domains and three attack strategies) and a 20-prompt adaptive case study. Targeted attack-success rate on AgentDojo is $\leq 1.9%$ across all five models, comparable to published defended baselines. Deterministic syntax recovery reduces the 3B model’s false rejection rate from 52% to 15.2% at zero latency cost; frontier models achieve 0%. Input sanitization flagged injection patterns in only 10.2% of injection prompts without solo-rejecting any, confirming pattern-based detection is insufficient. Within-scope intent manipulation remains an open problem the hard gates do not address. The architecture targets enterprise systems requiring explainability, safety, and regulatory compliance.