Multi-Tenant Department Isolation and Fail-Close RBAC in Enterprise AI Agents | IKAI HR