The Law module is billed as Anti-IDOR, but the sample tool doesn't quite deliver that. tenantId is a model-supplied argument in the zod schema, dataAccessGuard only checks that the model echoed the same tenantId as the session context, and execute() then calls db.invoices.findById(args.invoiceId) with no tenant filter at all. So the actual isolation rests entirely on the model always passing the right tenantId, not on the data layer refusing to return someone else's invoice. If invoiceId space is guessable or ever collides across tenants, that guard doesn't catch it. I'd derive tenantId from context server-side rather than accept it as a tool argument, and have execute() query by both invoiceId and tenantId, or at minimum check record.tenantId === context.tenantId after the fetch before it reaches llmDto.