Accounts from other companies are all displayed in the relationship. This should be a bug; it should only display the digital employees under the company's own account.

[yangcanlaigit]

Pre-checks

• I have searched existing issues and this is not a duplicate.

Deployment Method

Docker

Steps to Reproduce

Accounts from other companies are all displayed in the relationship. This should be a bug; it should only display the digital employees under the company's own account.

Expected vs Actual Behavior

This should be a bug; it should only display the digital employees under the company's own account.

Logs / Screenshots

Accounts from other companies are all displayed in the relationship. This should be a bug; it should only display the digital employees under the company's own account.

[Clawiee]

Thank you for reporting this bug! 🎯

Issue Analysis

This is a tenant isolation bug. The relationship/colleagues page is displaying digital employees from other companies' accounts, which is a serious data privacy and security issue.

Root Cause

After analyzing the codebase, I found the likely cause in backend/app/api/gateway.py:

# Line ~480 - in send_message endpoint
result = await db.execute(
    select(Agent).where(Agent.name.ilike(f"%{target_name}%"))
)

The agent lookup does NOT filter by tenant_id, which means:

• If your company has an agent named "Alice"
• And another company also has an agent named "Alice"
• The search returns BOTH agents regardless of which company you belong to

This violates the multi-tenant data isolation principle that Clawith should enforce.

Expected Behavior

The relationship/colleagues page should only display digital employees that belong to the current user's company/tenant, based on tenant_id filtering.

Possible Fix Locations

1. Backend API: Add tenant_id filter to agent lookup queries in gateway.py
2. Frontend: Ensure the frontend requests only query agents by the current user's tenant_id

Questions for the Reporter

1. Which page specifically shows the cross-tenant agents? (Digital Employee detail page? Relationship management?)
2. Are you using OpenClaw agents or Native agents?

---

I've flagged this to the Clawith development team (姚劲, 覃睿, 湛雨桐) for investigation and fix.

[yangcanlaigit]

1

感谢您报告此错误！🎯

问题分析

这是一个租户隔离漏洞。关系/同事页面会显示其他公司账户中的虚拟员工，这存在严重的数据隐私和安全问题。

根本原因

分析代码库后，我发现可能的原因在于backend/app/api/gateway.py：

Line ~480 - in send_message endpoint

result = await db.execute(
select(Agent).where(Agent.name.ilike(f"%{target_name}%"))
)
代理查找功能**不按tenant_id**以下方式筛选：

• 如果贵公司有一位名叫“Alice”的代理人
• 还有一家公司也有一位名叫“爱丽丝”的代理人。
• 无论您属于哪家公司，搜索结果都会返回两位经纪人的信息。

这违反了 Clawith 应该强制执行的多租户数据隔离原则。

预期行为

根据筛选条件，关系/同事页面应该只显示属于当前用户公司/租户的数字员工tenant_id。

可能的修复位置

1. 后端 APItenant_id ：在代理查找查询中添加筛选条件gateway.py
2. 前端：确保前端请求仅针对当前用户的查询代理。tenant_id

记者提问

1. 具体哪个页面显示了跨租户代理？（是“数字化员工详情页”吗？还是“关系管理”页面？）
2. 您使用的是 OpenClaw 代理还是原生代理？

我已经将此问题反馈给 Clawith 开发团队（姚劲、覃睿、湛雨桐），以便他们进行调查和修复。

1."Relationship Management" page
2. Native Agent

[yaojin3616]

Fixed in commit 1ecd642 (PR #246): Fix multi-tenant isolation gaps in permissions.py.

Root cause: The check_agent_access() function was not validating tenant_id match for non-admin users, allowing agents from other tenants to appear in relationship dropdowns.

Fix: check_agent_access() now validates tenant_id match for all users. The agent listing in relationship pages is now properly filtered by the current user's tenant.