Isolate Tenant Vector Retrieval

A vector index can retrieve semantically similar text from the wrong tenant even when the answer generator never cites the source. The retrieved chunk may influence the answer or appear in a debug trace. Treat embeddings, chunks, metadata, and retrieval results as copies of tenant data. OWASP Multi Tenant Security supplies the isolation goal; OWASP's LLM guidance highlights retrieval and embedding risks.

Record the metadata contract

For each chunk, store a trusted tenant owner, source document ID, document permission version, and deletion state. Do not accept tenant metadata solely from an uploaded document or model output. Map how an authorized user query becomes a filter at the vector store.

Test with synthetic documents

Create two tenants with similar wording but unique harmless markers. Ask a benign question as each tenant. Inspect raw retrieved IDs before answer generation, not only the final text. Remove a document or membership and repeat. Test a chunk without tenant metadata; it should be excluded rather than treated as global. If the vector store uses a shared namespace, test the filter on every retrieval path and fallback.

A correct final answer is not evidence that retrieval was safe. The artifact is the chunk metadata contract plus raw retrieval assertions. Keep real customer text out of this experiment. If a provider stores embeddings or logs prompts, verify its data terms before using private material. Hold the feature when ownership cannot be carried from source through answer.

Illustrative pipeline trace: verified A context -> vector query restricted to A and current document grants -> raw chunk IDs [A1, A2] -> reranker input [A1, A2] -> model context [A1, A2]. Add B1 with similar text and a chunk missing owner metadata. Assert neither appears in raw retrieved IDs, reranker input, prompt, citations, or trace output. If the provider cannot filter before retrieval, use a separately authorized namespace or hold that path.