A SaaS company runs Claude Agent SDK agents on shared infrastructure, one agent process per customer. During testing, an agent picked up a developer's user-level CLAUDE.md, project skills, and saved auto memory from the host machine, none of which belong in a customer's session. The team wants each customer's agent limited to what the application configures in code. Which approach follows the documentation?