Recommended Free Tools
To prevent one tenant’s data from appearing in another tenant’s RAG results, do not treat a stored tenant_id or a vector-search filter as the whole security system. Authenticate the caller, derive their permitted scope on the server, enforce that scope during every retrieval before chunks reach the model, and carry permission changes through caches and derived data.
A tenant field can help implement authorization; it cannot prove who is making a request or establish which documents that person may access. The practical question is not simply whether a database supports tenant filtering, but whether every request path uses trusted authorization context and fails closed when it cannot.
As an Amazon Associate I earn from qualifying purchases.
Where a tenant filter stops being enough
A row or chunk labeled tenant_id = "acme" describes the data. It does not authenticate the requester, prove that the label is correct, or decide whether a user in Acme may read that particular chunk. Those decisions belong to an authorization system tied to trusted identity.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The Microsoft Architecture Center’s secure multitenant RAG guidance describes a flow from identity provider through application and orchestrator to the data store. It recommends placing an API in front of storage as a gatekeeper. The OWASP RAG Security Cheat Sheet likewise advises keeping access-control metadata with each chunk and checking authorization at retrieval time.
#1 Best Overall
That distinction matters because RAG systems have several handoffs. A caller’s identity can be lost or weakened between the API, orchestration code, retriever, search service, and tools used by an agent. If even one path performs an unrestricted search—or accepts a tenant scope supplied by the caller without validating it—the resulting chunks may cross a boundary. Filtering after retrieval is not an equivalent safeguard: unauthorized content has already been returned to application code and may be included in the model’s context.
Enforce authorization along the request path
Design the path so each component receives only the authority it needs, and so the model never sees content that the caller is not allowed to retrieve.
Rank #2
- Authenticate the request. Validate the session or token with the identity system. Do not use a request-body field, prompt, or client-selected database filter as proof of tenant membership.
- Derive authorization context on the server. Map the authenticated identity to its tenant and, where relevant, its user, role, group, or document permissions. Resolve this from trusted server-side policy or identity claims that the server validates.
- Constrain every retrieval route. The application or orchestrator should pass a scope the caller cannot broaden. Apply tenant and finer-grained permissions as part of the retrieval operation—not as a cleanup step after unrestricted results return.
- Limit model context to authorized chunks. Only after the retrieval service has enforced the boundary should it pass grounding content to the model. The model is not the authorization layer; asking it to ignore another tenant’s data cannot undo exposure.
- Record what happened. Log the authenticated identity and useful access metadata for retrieved chunks, consistent with privacy and retention requirements. Logs should help investigate unexpected results without becoming an uncontrolled copy of sensitive content.
OWASP’s Chunk Isolation guidance states: “A query from one context must not retrieve chunks from another context.” This is an enforcement objective, not a claim that any one filter or test proves an implementation secure.
Choose an isolation boundary that fits the threat model
Shared storage is not automatically insecure, and separate resources are not automatically sufficient if application authorization is still wrong. The options below differ in the boundary they provide and the operational work they entail.
| Pattern | Boundary and possible fit | Important limitation |
|---|---|---|
| Shared collection or index with a tenant pre-filter | One store contains multiple tenants; retrieval applies a tenant constraint. MongoDB Vector Search documents a shared collection, database, and cluster with a tenant_id pre-filter for tenants that can share one VPC. |
This is product-specific guidance, not a general rule for every database or compliance requirement. MongoDB’s guidance says separate projects are needed where tenants cannot share a VPC. Verify actual filter behavior, index configuration, and all access paths. |
| Tenant-specific namespace, collection, or index | A separate logical retrieval scope can make tenant targeting and cross-boundary checks easier to reason about. | Logical separation can still share underlying infrastructure and control planes. Confirm that this boundary meets the threat model and audit requirements. |
| Dedicated store or service resource per tenant | Distinct resources can support stronger customer-level separation where compliance or infrastructure boundaries require it. AWS recommends a dedicated Amazon Bedrock knowledge base per tenant with IAM-enforced boundaries for hard cross-customer isolation. | More resources can mean additional deployment, ingestion, maintenance, and cost work. The boundary still depends on correctly configured identity and permissions. |
| Policy-filtered access within one tenant | A runtime policy can narrow access by team, department, or role inside an organization. AWS describes using Verified Permissions and Cedar policies to produce metadata filters for this kind of access. | AWS characterizes this as filter-level logical isolation, not IAM-enforced isolation; it is not a substitute for hard SaaS customer boundaries. |
For Amazon OpenSearch Service, AWS describes combining JWT context with fine-grained access control and tenant routing, with domain-, index-, and document-level patterns. Its guidance treats the right isolation approach as dependent on the required strictness, management burden, and cost. These are vendor-specific designs: confirm current product behavior and configuration against the relevant service documentation before adopting one.
Questions to use when comparing designs
- Boundary strength: Is the separation enforced by application filters, logical scopes, IAM, dedicated resources, or a combination?
- Permission granularity: Is access only tenant-wide, or does it also vary by user, role, team, or document?
- Failure behavior: If identity context or policy evaluation is missing, does retrieval stop rather than broaden access?
- Freshness: How quickly do role changes, revocations, and source permission changes affect retrieval?
- Coverage and evidence: Can operators see which scope was applied and which chunks were returned, and can they audit each retrieval path?
- Lifecycle and operations: How are deletions propagated, and what are the deployment, maintenance, scaling, noisy-neighbor, and cost-allocation consequences?
Protect derived data and permission changes
Authorization is not finished when a document is first ingested. A source document can be deleted or its permissions can change while its chunks, embeddings, caches, or derived indexes remain available. If retrieval checks only the original ingestion-time label, it may use stale access information.
Define a lifecycle process that updates or removes every representation used for retrieval when its source or permissions change. Include cached answers and retrieval results in that inventory: a cache key or cache lookup that does not account for authorization scope can bypass otherwise correct retrieval controls. Recheck current permissions when serving content where needed, and make deletion propagation observable so operators can detect incomplete cleanup.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test for cross-tenant leakage repeatedly
OWASP recommends cross-tenant test queries and checking for zero cross-boundary results. Treat that as a recurring verification practice for the paths and states tested—not as a guarantee that untested paths are safe.
- Swap identities: Run the same query as users from different tenants and verify that each receives only its authorized content.
- Vary roles and document access: Test users within one tenant who have different roles or permissions, including documents that are explicitly not permitted.
- Exercise every entry point: Cover direct search, chat, agent and tool retrieval, background jobs, alternate APIs, and any administrative or support workflow that can query the store.
- Probe scope handling: Try a caller-supplied tenant identifier or an altered filter and confirm the server does not allow the request to widen its authorized scope.
- Test changes over time: Revoke access, change a source permission, and delete a source; then check retrieval, caches, embeddings, and indexes for stale results.
- Check failure and audit behavior: Simulate missing or invalid identity context and policy-service errors, confirm access fails closed, and verify that logs capture the identity and applied scope needed to investigate results.
There is no universal storage layout that guarantees tenant safety across products. The reliable design is the one whose trusted identity mapping, retrieval-time enforcement, lifecycle handling, and verification all match the boundary your customers and compliance obligations require.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
