[Blog](https://cohesivity.ai/blog) Agent-native backend Published Jun 29, 2026·Updated Aug 30, 2026 ![](https://cohesivity.ai/authors/arag.webp)![](https://cohesivity.ai/authors/shouryamaan.webp)[Arag](https://www.linkedin.com/in/aragagrawal/) and [Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/) # Why AI-Generated Applications Still Need Better Backend Infrastructure [Read as Markdown](https://cohesivity.ai/blog/why-ai-generated-apps-still-need-better-backend-infrastructure.md) Builder App State Auth An AI-generated application still needs the same backend controls as any other application: server-side secrets, authorization, tenant isolation, safe writes, migrations, budgets, observability, and recovery. Generating working UI and API code does not prove those controls exist. The fastest review is a second-user test. Create two users, two tenants, and two records, then try to cross every boundary the first-user demo never exercised. ## A working demo proves one path A coding agent usually optimizes for the acceptance test it can see. If the task says "build a notes app," a form that inserts and lists notes may satisfy it. The task may never ask whether one user can request another user's note ID, whether a timed-out insert repeats, or whether the browser bundle contains a management key. That is a specification problem and an infrastructure problem. The review needs to make the missing constraints executable. ## Secrets must stop at the server Search generated JavaScript, source maps, mobile bundles, committed environment files, logs, and error responses for provider and management credentials. Public clients should receive only credentials designed for public use or short-lived tokens limited to the current user and action. The [OWASP API Security Top 10](https://owasp.org/API-Security/) treats broken object authorization and authentication as distinct risks. Authentication proves who the caller is. Authorization decides whether that caller may access this object. The [agent security guide](https://cohesivity.ai/blog/ai-agent-security-identity-permissions-secrets-audit-logs) shows how to keep the agent's build credential separate from the deployed application's identity. ## Tenant isolation belongs in every data path Adding `tenant_id` to one table is insufficient. Every read, update, delete, file lookup, cache key, background job, search index, realtime channel, and export must carry the same tenant boundary. Test direct object references: 1. Sign in as tenant A and create a record. 2. Sign in as tenant B. 3. Request tenant A's record by ID through every public API path. 4. Repeat the test for update, delete, export, file, and subscription endpoints. 5. Confirm the server returns the same non-disclosing result for missing and unauthorized records where appropriate. The guide to [multi-tenant agent infrastructure](https://cohesivity.ai/blog/multi-tenant-infrastructure-for-ai-agents) covers database, quota, and shared-state boundaries together. ## Writes need replay protection Network failures create unknown outcomes. The server may commit a write before the client loses the response. If the agent or browser retries without an idempotency key, one click can produce two orders, messages, deployments, or charges. For each write, define the logical operation ID, store its first result, reject conflicting reuse, and document the retention window. The recovery flow in [agent retries and checkpoints](https://cohesivity.ai/blog/ai-agent-failure-recovery-retries-checkpoints-human-approval) handles the case where the caller cannot tell whether the first attempt completed. ## Migrations need a recovery path Generated migrations often receive less review than generated application code, even though they can change every existing row. Before applying one: - inspect the generated SQL rather than only the ORM command; - identify locks, table rewrites, and destructive clauses; - run it against a production-shaped copy of data; - test the old and new application versions during the transition; - define rollback or forward repair for partial deployment. Do not give a coding agent unrestricted production DDL because it wrote the migration itself. Supabase's [MCP security guidance](https://supabase.com/docs/guides/ai-tools/mcp) explicitly recommends development projects, project scoping, and avoiding production data. Apply the same rule to any backend tool. ## Costs need server-enforced limits Cap model calls, paid tools, database requests, background work, storage, and runtime per tenant and per workflow. A prompt asking the agent to keep costs low is not enforcement. Track the cost of failed and retried runs in the cost per completed outcome. The [AI agent infrastructure cost guide](https://cohesivity.ai/blog/ai-agent-infrastructure-costs) provides the calculation and budget points. ## Infrastructure should make the safe path direct The backend should return scoped credentials, structured errors, idempotent writes, status records, and bounded service access by default. A review can catch missing controls once. A platform contract can prevent the same omission on every new project. Cohesivity gives a coding agent an isolated tenant and server-side access to supported backend services without exposing upstream provider credentials. The application still owns row-level authorization, approval rules, and safe schema design. ## Run the second-user test before inviting anyone Use two users and two tenants against a disposable environment. Try cross-tenant IDs, repeated writes, expired credentials, failed migrations, and exhausted limits. Record the exact request and server result for each failure. The prompt below turns that review into a file-by-file audit before it changes anything. or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+AI-generated+application+as+if+a+second+user+and+second+tenant+arrived+today.+Do+not+modify+code.+Trace+signup%2C+authentication%2C+authorization%2C+data+writes%2C+file+access%2C+background+work%2C+external+API+calls%2C+retries%2C+logging%2C+and+deletion.+Find+any+client-visible+secret%2C+shared+administrator+credential%2C+missing+tenant+predicate%2C+guessable+resource+access%2C+non-idempotent+write%2C+unbounded+loop%2C+destructive+migration%2C+or+log+containing+sensitive+data.+For+each+finding%2C+cite+the+exact+file+and+code+path%2C+describe+a+reproducible+test%2C+and+propose+the+smallest+server-enforced+fix.+If+the+app+has+no+backend+yet%2C+identify+the+minimum+Cohesivity+resources+needed%2C+but+do+not+provision+them. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+AI-generated+application+as+if+a+second+user+and+second+tenant+arrived+today.+Do+not+modify+code.+Trace+signup%2C+authentication%2C+authorization%2C+data+writes%2C+file+access%2C+background+work%2C+external+API+calls%2C+retries%2C+logging%2C+and+deletion.+Find+any+client-visible+secret%2C+shared+administrator+credential%2C+missing+tenant+predicate%2C+guessable+resource+access%2C+non-idempotent+write%2C+unbounded+loop%2C+destructive+migration%2C+or+log+containing+sensitive+data.+For+each+finding%2C+cite+the+exact+file+and+code+path%2C+describe+a+reproducible+test%2C+and+propose+the+smallest+server-enforced+fix.+If+the+app+has+no+backend+yet%2C+identify+the+minimum+Cohesivity+resources+needed%2C+but+do+not+provision+them. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+AI-generated+application+as+if+a+second+user+and+second+tenant+arrived+today.+Do+not+modify+code.+Trace+signup%2C+authentication%2C+authorization%2C+data+writes%2C+file+access%2C+background+work%2C+external+API+calls%2C+retries%2C+logging%2C+and+deletion.+Find+any+client-visible+secret%2C+shared+administrator+credential%2C+missing+tenant+predicate%2C+guessable+resource+access%2C+non-idempotent+write%2C+unbounded+loop%2C+destructive+migration%2C+or+log+containing+sensitive+data.+For+each+finding%2C+cite+the+exact+file+and+code+path%2C+describe+a+reproducible+test%2C+and+propose+the+smallest+server-enforced+fix.+If+the+app+has+no+backend+yet%2C+identify+the+minimum+Cohesivity+resources+needed%2C+but+do+not+provision+them. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+AI-generated+application+as+if+a+second+user+and+second+tenant+arrived+today.+Do+not+modify+code.+Trace+signup%2C+authentication%2C+authorization%2C+data+writes%2C+file+access%2C+background+work%2C+external+API+calls%2C+retries%2C+logging%2C+and+deletion.+Find+any+client-visible+secret%2C+shared+administrator+credential%2C+missing+tenant+predicate%2C+guessable+resource+access%2C+non-idempotent+write%2C+unbounded+loop%2C+destructive+migration%2C+or+log+containing+sensitive+data.+For+each+finding%2C+cite+the+exact+file+and+code+path%2C+describe+a+reproducible+test%2C+and+propose+the+smallest+server-enforced+fix.+If+the+app+has+no+backend+yet%2C+identify+the+minimum+Cohesivity+resources+needed%2C+but+do+not+provision+them. "Send to OpenCode")