Hard20 minAI Engineering
UpdatedAug 6, 2026
Edit

Vector Search: Tenant Isolation

Question Variations

  • "Why is prompt-only access control insufficient?"
  • "When would separate indexes be preferable to filtered namespaces?"
  • "How would you prevent cross-tenant retrieval leakage in a shared vector index?"

Why This Is Asked

This evaluates whether a candidate treats retrieval as a data-access boundary, not merely a search problem. Interviewers look for authorization enforced before context reaches the model, trustworthy metadata, defense in depth, and adversarial testing.

Key Concepts

  • Authorization filter: Enforce tenant and document permissions before returning context.
  • Defense in depth: Validate access in the application even if the store supports filters.
  • Metadata integrity: Index trusted access attributes with every vector.
  • Testing: Include cross-tenant adversarial queries in evaluation.

Question Variations

  • “Why is prompt-only access control insufficient?”
  • “When would separate indexes be preferable to filtered namespaces?”
  • “How would you prevent cross-tenant retrieval leakage in a shared vector index?”

Answers by Technology

+ Add Variant
System DesignImprove this answer ✏️

Expected Answer

Similarity must never decide access. I derive tenant and permission filters from the authenticated identity, apply them before ranking, and validate the returned documents again in the application. Ingestion owns trusted access metadata; callers never supply it. Separate indexes are justified when legal isolation or blast radius requires it. I would test adversarial cross-tenant queries and audit filter decisions without logging document contents.

Why It Matters

Similarity is not authorization; one leaked chunk can expose another customer’s data.

Common Mistakes

  • Using a prompt to enforce tenancy: The model cannot be the security boundary.
  • Accepting caller-supplied tenant IDs: Attackers can request another namespace.

Follow-up Questions

  • When use separate indexes? (Answer: When isolation requirements outweigh operational cost.)
  • Where is filtering enforced? (Answer: At retrieval and application authorization layers.)