ADR-0030 derives a per-session storage scope from the attested owner plus the chat handle. The chat handle arrives today as a transport hint (X-Chat-Id), so within-tenant separation is client-cooperative, not a cryptographic boundary. A hard within-tenant boundary requires the chat id on an attested channel (an embed-token claim) rather than a transport header. Tracked from ADR-0030 Open questions item 1.
ADR-0030 derives a per-session storage scope from the attested owner plus the chat handle. The chat handle arrives today as a transport hint (
X-Chat-Id), so within-tenant separation is client-cooperative, not a cryptographic boundary. A hard within-tenant boundary requires the chat id on an attested channel (an embed-token claim) rather than a transport header. Tracked from ADR-0030 Open questions item 1.