mcp tool execution in multi-tenant environments - what isolation boundaries are people actually enforcing

We're deploying mcp tools in a multi-tenant SaaS context where different customers share the same tool infrastructure but shouldn't see each other's data or internal topology. The sdk documentation doesn't cover isolation boundaries at all, and I'm worried about several attack surfaces: (1) tool errors leaking internal state across tenant boundaries, (2) llm context pollution when one tenant's tool output contains references to another tenant's resources, (3) tools that call external apis potentially exposing tenant-specific credentials or endpoints. I know Docker + network policies is the obvious answer for process isolation, but what about logical isolation within the tool layer itself? Are people building tenant-aware tool registries, sanitizing all tool outputs before they hit llm context, validating that tool parameters don't reference cross-tenant resources? The security model here feels completely underspecified and I haven't found much discussion about it. This seems like the kind of thing that could go very wrong very fast in production, especially since llms are pretty good at coaxing information out of error messages.