RAG & LLM Agents for B2B SaaS — Tenant-Isolated, Enterprise-Approved

Isolation is enforced at the vector store, not in application code. On Pinecone, every tenant gets a dedicated namespace and the retrieval call takes a typed tenant ID that resolves to exactly one namespace — a cross-tenant call becomes a compile error rather than a missed filter. On pgvector, a Row-Level Security policy on the chunks table makes the database itself reject a query that does not carry the tenant context, regardless of which code path called it. The eval harness includes a cross-tenant leakage test that fails the build if a query for org A surfaces a chunk owned by org B, so a regression cannot ship undetected.

Tier gating runs through the same entitlements layer your existing seat and feature flags use, not a parallel system. The LLM SDK wrapper checks the org's entitlement for the specific AI capability (agent_basic, agent_advanced, eval_harness_access, cost_dashboard) before issuing the call, so a Pro org calling an Enterprise-only endpoint gets the same 'upgrade required' shape your other gated features return. The wrapper is also the place per-request cost gets attributed to the org, so the entitlement check and the cost attribution happen at the same chokepoint.

Agent actions run as the seat that triggered them. Every tool call the model proposes goes through your existing authorization layer — the same checks that gate the human seat's API requests — before the side effect runs. If the seat lacks delete on a resource, the agent's delete tool call returns a permission_denied tool_result that the model can recover from rather than completing the action. Permissions provisioned via SCIM flow through unchanged because SCIM populates the group memberships your authz layer already reads; the agent inherits whatever the seat has, no more.

Admin-panel AI surfaces are wrapped in fallback contracts. A churn-risk summary that fails to generate falls back to the structured signals it would have summarized — open tickets, login decline, billing event — rendered as a plain list rather than a missing widget. An anomaly callout that the model declines on still surfaces the underlying metric delta. Triage suggestions that come back malformed get caught at the schema layer and the ticket lands in the default queue. The admin panel typically does not end up in a state where an AI failure leaves the operator without the underlying data.

Every LLM call flows through a thin SDK wrapper that writes a row to a llm_usage table with org ID, feature, model, input tokens, output tokens, cached tokens, latency, and computed cost. The org-owner view in your admin panel reads from that table and shows AI spend by feature and month — the same shape the seat-and-usage view already shows for the rest of your product. Procurement gets a defensible line item with the same provenance as the rest of their bill, and your finance team gets a cost rollup they can reconcile against the underlying OpenAI or Anthropic invoice.

The eval harness is the same one your CI already runs internally, exposed in the Enterprise tier behind a typed API or a Studio-style UI. The buyer ships a frozen set of representative queries with expected behaviors — answer shape, grounding spans, refusal cases — and the harness reports pass/fail, the cost delta against the previous run, and a diff of any behavior changes since the last evaluation. The eval runs against the same retrieval and agent stack production uses, scoped to a non-production tenant they own, so the result is a real measurement rather than a marketing screenshot.

The data flow is documented because the wrapper makes it explicit. Retrieval pulls only chunks owned by the calling org's tenant namespace. The system prompt and tool schemas are tenant-agnostic. The user turn plus retrieved context plus any tool_result content is what reaches the provider. No cross-tenant chunks, no PII outside what the org has loaded into its own corpus, no telemetry that mixes tenants. If the buyer requires a no-training data agreement or a zero-data-retention configuration with the provider, the wrapper routes that org's traffic through the configured endpoint and the audit log records which route every call took.

For a B2B SaaS already running tenant isolation in the rest of its stack and with an existing auth layer the agent can call into, layering per-tenant RAG plus the agent loop plus the cost and entitlement wiring is typically a 4 to 8 week build, scoped to one or two flagship AI surfaces and the shared infrastructure underneath. The faster variable is usually how clean your existing entitlements and SCIM provisioning are; the slower variable is the customer-facing surface — chatbot UI, admin-panel widgets, eval harness API — that the AI feature actually lives on.