One prompt. Empty account → multi-tenant SaaS.
Every claim machine-checked.

1Two problems, one entry

A SaaS security problem and an agentic-coding reliability problem — this project sits at the intersection.

2What we built

Three artifacts, one thesis: the prompt is the product, the gates are the proof.

3Inside the prompt — 405 lines, dissected

Not a wall of wishes. A quarter of it is operating rules and a failure playbook — the agent's runtime, not its task. Every line is load-bearing; here's where they go.

Three design decisions to notice, with the actual text:

R3. **Never hand-type a version number.** Install everything with
    `npm install <pkg>@latest` (or no tag) and let the registry resolve. You do not
    know current versions; every guessed pin in the prior run ([email protected],
    [email protected], [email protected]) failed install. After install, READ
    package.json to learn what you got.

Each rule names the failure that created it. The agent isn't told "be careful" — it's told what went wrong last time and what to do instead. The evidence requirement works the same way: R6: gates are scripts, not prose… Claims without a result file don't count.

TenantDataAccessRole — USE THIS TRUST PATTERN VERBATIM:
const assumers = ['api-lambda', 'consumer', 'gate-runner']
  .map(n => `arn:aws:iam::${this.account}:role/${appName}-${envName}-${n}`);
const trustCond = { ArnEquals: { 'aws:PrincipalArn': assumers } };
this.tenantDataAccessRole = new iam.Role(this, 'TenantDataAccessRole', {
  roleName: `${appName}-${envName}-tenant-data-access`,
  assumedBy: new iam.AccountPrincipal(this.account).withConditions(trustCond),
});
…plus an explicit sts:TagSession statement, then:
NEVER trust `lambda.amazonaws.com` here: at runtime the AssumeRole caller is the
execution-role SESSION, not the Lambda service — service-principal trust both
fails at runtime and would let any Lambda in the account mint tenant credentials.

A prior run "fixed" this exact trust policy into something that deployed green and silently destroyed the guarantee. So the prompt stops delegating here: the security-critical pattern is supplied, with the anti-pattern named and explained. Generate the boilerplate; dictate the invariant. Compare the deployed core-stack.ts in the repo — it matches character for character.

| Symptom                              | Likely cause                | Fix |
| Deploy: "Invalid principal in policy"| trust names a not-yet-existing role | principals are existence-checked; conditions are not → AccountPrincipal + PrincipalArn condition |
| DLQ count still 0 after one check    | polled too early            | 3 receives × 180s visibility ≈ 9–12 min; poll 30s up to 15 min |
| API JSON errors arrive as 200 HTML   | distribution-wide errorResponses | CloudFront Function URI-rewrite on default behavior |

Paired with rule R7 — match a row, state root cause in one paragraph, max two fix attempts per error — this is what replaced blind retry loops. In the live run, the dead edge stack was recovered through exactly this table. The full prompt is in the repo at docs/PROMPT.md.

4The isolation mechanism

Standard serverless edge-to-data path, one unusual property: cross-tenant access isn't a bug you avoid — it's a permission that doesn't exist.

Browser ── CloudFront (+WAF, TLS) ──┬── S3 site (private, OAC)
                                    └── /v1/* → HTTP API ── Cognito JWT authorizer
                                                  │
                                             API Lambdas ── EventBridge ── SQS (+DLQ ×3) ── consumer
                                                  │
   tenant_id claim (injected by fail-closed pre-token trigger — no tenant, no token)
                                                  │
   STS AssumeRole + session tag tenant_id=<from JWT>   ← scoped creds, 15 min, cached
                                                  │
   DynamoDB policy:  dynamodb:LeadingKeys = "TENANT#${aws:PrincipalTag/tenant_id}#*"
                     on table AND every GSI · Scan permission does not exist

The trust policy itself is hardened: account principal constrained by aws:PrincipalArn, with sts:TagSession explicit — because the obvious alternative (trusting the Lambda service principal) both breaks at runtime and would let any Lambda in the account mint tenant credentials.

5The nine gates — and the money gate's receipt

Each gate is the contract for its phase. The agent cannot deploy the next stack until the current gate's JSON is green.

E1Gate 2 — the isolation prooffour raw AccessDeniedExceptions

{"gate":2,"checks":[
 {"name":"own-partition write+read as t-aaaaaaaa","actual":"item readable","pass":true},
 {"name":"cross-tenant Query","actual":"AccessDeniedException","pass":true},
 {"name":"cross-tenant GSI1 Query","actual":"AccessDeniedException","pass":true},
 {"name":"Scan with tenant creds","actual":"AccessDeniedException","pass":true},
 {"name":"AssumeRole without tenant_id tag","actual":"AccessDeniedException","pass":true}],"pass":true}

6The live run — the gates caught the builder

June 10, 2026, clean account, agent running detached on an EC2 build host under the instance role. Five real defects, each caught by a gate, fixed via the playbook, re-proven green — zero human debugging.

E2The site, live through CloudFront + WAFd12p64mor0h8l0.cloudfront.net

E3Same domain: healthz 200 JSON · tokenless 401 · gate manifestone take, live URL

E4Three stacks — the timestamps tell the recovery storypre-teardown

7Day-2 proof — monitoring that actually detects

Observability isn't a dashboard screenshot; it's a detection loop closed end-to-end.

E5The dashboard, with real trafficlaunchtest-staging-overview

E6Seven alarms — one correctly firinga true positive, not a flaw

E7The alarm email — the loop reaches a humaninbox, 13:52 UTC

E8The receipts, re-verified on a second machinegates 0–7, all PASS

8Agent reliability engineering — what's in the prompt

Each rule is a converted post-mortem. The ones that matter most for anyone running coding agents against real cloud accounts:

9Why this matters

The prompt is the product.
The gates are the proof.