You are designing a Retrieval-Augmented Generation (RAG) platform that serves more than 500 enterprise customers.Â
Each customer uploads proprietary documents and expects complete data isolation.Â
A critical concern is preventing situations where
1. Customer A’s chatbot retrieves Customer B’s documents
2. Embeddings from different tenants are mixed
3. Prompt context accidentally includes another tenant’s data
4. Authorization checks are bypassed
How would you design a secure multi-tenant RAG architecture that guarantees tenant isolation while maintaining scalability and performance?
Discuss:
A. Vector database design
B. Namespace and partitioning strategies
C. Metadata filtering
D. Authentication and authorization
E. Embedding storage
F. Retrieval security
G. Audit logging
H. Zero-trust architecture principles
Explain the trade-offs between shared and dedicated infrastructure and how you would validate that tenant isolation is working correctly.Â
Multi-tenant security is one of the most critical requirements for enterprise RAG systems.
A single retrieval mistake can expose confidential customer information and create severe regulatory and compliance risks.
My architecture would include multiple layers of isolation.
1. Tenant-Aware Ingestion
Every document receives:
– Tenant ID
– Document ID
– Owner metadata
– Classification metadata
No document enters the system without a tenant identifier.
2. Vector Database Isolation
Preferred approach:
– Dedicated namespace per tenant
Examples:
Tenant-A
Tenant-B
Tenant-C
This prevents vectors from being mixed during retrieval.
For highly regulated industries such as banking or healthcare, I may use separate vector indexes or even separate infrastructure.
3. Mandatory Metadata Filtering
Every retrieval query automatically applies:
Tenant ID = Current User Tenant
before similarity search is executed.
This filter must be enforced server-side and never rely on client input.
4. Authentication and Authorization
Integrate with:
– OAuth
– OpenID Connect
– Azure AD
– Okta
The authenticated user’s tenant context is propagated through the entire retrieval pipeline.
5. Retrieval Security Layer
Query
→ Authentication
→ Authorization
→ Tenant Validation
→ Vector Search
→ Context Assembly
→ LLM
No retrieval operation occurs before authorization validation.
6. Audit Logging
Log:
– User ID
– Tenant ID
– Query
– Retrieved Documents
– Timestamp
This enables forensic investigations and compliance reporting.
7. Zero-Trust Principles
Assume every request is untrusted.
Validate:
– Identity
– Tenant
– Permissions
– Resource ownership
at every stage.
8. Testing Strategy
Perform:
– Cross-tenant penetration testing
– Synthetic tenant validation
– Retrieval security tests
– Automated policy verification
Production Recommendation
For most enterprise environments:
Tenant-Aware Metadata + Namespace Isolation + Mandatory Authorization Checks
provides the best balance between security, scalability, and operational cost.
For highly regulated industries, dedicated vector stores per tenant may be justified despite increased operational complexity.