Multi-tenant retrieval becomes a security problem the moment a search result can cross an account boundary. A vector store’s similarity score does not know whether the user is entitled to see a document. Isolation must be enforced in the retrieval request and verified against the authoritative permission model.
Where the leak occurs
A pipeline may validate tenant access for the initial document upload but omit that restriction when searching embeddings, reranking candidates, following references or loading the original file. An agent can then cite or summarize a document from another account. Decide whether the store supports hard tenant partitioning, document ACL filters or separate deployments. Whatever the storage layout, evaluate authorization again when a retrieved identifier is used to load source content.
Isolation models are not interchangeable
Weaviate documents multi-tenant collections with data kept in tenant shards; this is a product capability that still relies on callers supplying the correct tenant. Azure AI Search describes an approach using security-principal fields and filters; its documentation stresses that a string filter is not itself authentication. Application code therefore has to bind the authenticated principal to a validated tenant selector, never to a tenant ID proposed by the model or a retrieved document.
A permission-sensitive test
Seed a corpus with near-identical contract fragments belonging to Tenant A and Tenant B, including intentionally tempting secret-like markers. Ask a Tenant A agent the same question using direct similarity search, hybrid search, reranking and follow-up fetches. Verify that no text or metadata from Tenant B reaches the model, final answer, logs, cache or tool result. Repeat under administrator and revoked-user roles. A passing test requires checking server-side query filters and final document access, not only the output text.
Revocation and stale indexes
Permissions change after the indexing job completes. Use a data model in which revocation is checked before answer construction, and propagate changed ACLs to search indexes, caches and copied excerpts. If index propagation is asynchronous, temporarily deny access to affected records until the store confirms the new policy. Record identity, tenant, document revision, index snapshot and retrieval trace without writing protected document text into broad-access telemetry.
Buying and deployment implications
Ask a vendor about tenant partitioning, index-level permission expressions, reranking placement, backup isolation and deletion guarantees. A shared index can be economical yet require careful policy enforcement and performance tests. A dedicated index or deployment can simplify some controls but increase operational cost. This guide does not assert any region-specific security certification, quota or enterprise contract feature without a dated vendor record.
Plan partitioning before indexing
Tenant IDs, ACLs and document revisions should travel together from ingestion to chunking, embeddings and final citation rendering. A query-time tenant filter added as an afterthought is easy to omit from reranking or tool-result expansion. If the organization supports mixed-access teams, design how group membership affects search without turning every request into unrestricted administrator access. Treat index names and tenant labels supplied by an LLM as untrusted input.
Production acceptance and review test
Measure negative cases using sentinel documents per tenant, revoked users and expired group membership. Perform tests against vector-only, keyword-only and hybrid paths, as well as caches and source-link fetches. The acceptance criterion is zero unauthorized text reaching model context, logs or responses. Record any missing coverage as a release blocker rather than a minor hallucination issue.
Scope, version and availability
Features documented by a current vendor page are not assumed to have existed in earlier releases. Where a historical launch date is provided, it is supported by a dated first-party publication. Exact subscription tier, market availability, quotas, API billing, licensing permissions and deployment regions are not asserted without a directly applicable record. This is researched editorial guidance rather than a claim of independent hands-on testing, deployed operation or statutory certification.
Sources and Further Reading
- Weaviate — Multi-tenancy operations (source reviewed 2026-10-25)
- Microsoft — Security Filter Pattern for Azure AI Search (source reviewed 2026-10-25)