Removing the tenant ID from an MCP schema blocked 26 of 26 cross-tenant reads a validated parameter allowed.

A multi-tenant tool that accepts a tenant identifier and validates it against the caller's entitlement is still delegating resource selection to a process whose context an attacker may control (arXiv 2609.14780). In a 373-trial ablation across eight model configs and two transports, the correctly validated parameter served every out-of-scope attempt. With the parameter removed from the schema and scope bound to a verified credential below the agent, no tool signature could express the read, though 12 of 56 trials still escaped by forging writable scope. Design note buried in the paper: set-valued scope caused a 57x latency ratio under function-wrapped membership predicates until a JSON_TABLE lateral join recovered index access.