Encrypting tenant_id as a claim and forwarding it to downstream APIs prevents the model from gaining unauthorized cross-tenant access via prompts, because the tenant information comes from the token rather than the prompt.