Skip to main content
Knackline

Production RAG

Tenant isolation for multi-tenant RAG: ACLs that survive multi-hop retrieval

ACL patterns that survive multi-hop retrieval in multi-tenant RAG.

Chunk filters applied once still leak across hops and summaries

Published
Updated
Reading time
7 min read

Key takeaways

  • Name the post-demo failure mode before adding autonomy.
  • Encode controls as contracts: tools, ACLs, evals, and approvals.
  • Measure task success and incident reconstructability, not only latency.
  • Roll out shadow → limited write → full with kill switches.

How do I enforce tenant isolation at the vector index level?

Tenant isolation at the index level is achieved by partitioning the vector store into dedicated namespaces per tenant. Each tenant’s embeddings are stored in a separate namespace, and the retrieval layer is configured to query only the namespace that matches the authenticated tenant ID. This prevents accidental cross‑tenant retrieval before any ACL checks.

Mechanisms:

  • Namespace separation in the vector store (e.g., separate Pinecone namespaces or separate tables in Milvus).
  • TenantAuthContract validates the user’s tenant ID before any query.
  • IndexIsolationContract enforces that the query context includes the tenant namespace; any request that omits or mis‑specifies the namespace is rejected.

What are the risks of single‑pass chunk filtering in multi‑hop RAG?

If chunk filtering is applied only once at the first retrieval hop, subsequent hops can re‑introduce previously filtered chunks. The LLM may then aggregate or summarize data that belongs to a different tenant, leading to data leakage.

Mechanisms:

  • ChunkACLContract validates ACL on every chunk before it is passed to the next hop.
  • SummaryGuardContract inspects generated summaries for tenant tags and rejects any that aggregate cross‑tenant content.
  • AuditTrailContract logs every ACL check so that leaks can be traced.

How can I audit ACL violations in real time?

Real‑time auditing requires capturing every ACL decision and exposing it to monitoring tools. By emitting structured events for each ACL check, you can stream them to a log aggregation system and trigger alerts if a violation occurs.

Mechanisms:

  • AuditTrailContract records the tenant ID, chunk ID, ACL outcome, and timestamp.
  • Kill switch can be triggered automatically if a violation threshold is exceeded.
  • Tool registry includes a real‑time audit logger that forwards events to Prometheus/Grafana.

Which contracts provide the strongest defense against cross‑tenant leaks?

The combination of TenantAuthContract, IndexIsolationContract, ChunkACLContract, SummaryGuardContract, and AuditTrailContract forms a layered defense. Each contract enforces isolation at a different stage: authentication, storage, retrieval, summarization, and audit.

Mechanisms:

  • TenantAuthContract ensures the request originates from a verified tenant.
  • IndexIsolationContract guarantees the query hits only the correct namespace.
  • ChunkACLContract filters chunks per tenant at every hop.
  • SummaryGuardContract validates that the final answer contains only the tenant’s own tags.
  • AuditTrailContract provides forensic visibility.

A phased rollout mitigates risk while validating isolation. Start with a shadow deployment that runs ACL checks in parallel to the legacy path, then move to a limited rollout for a subset of tenants, and finally a full global rollout with continuous monitoring.

Phased Rollout Steps:

  1. Shadow , Deploy ACL contracts in parallel, compare outputs, and log any discrepancies.
  2. Limited , Enable ACL enforcement for a controlled group of tenants; monitor latency, accuracy, and audit logs.
  3. Full , Roll out to all tenants; enable the kill switch to halt the system if a critical breach is detected.

Evaluation: Use an eval set of synthetic queries that test cross‑tenant boundaries. The tool registry should include a test harness that automatically runs these queries against both legacy and ACL‑enforced paths.

How do I validate that summaries respect tenant boundaries?

Validation involves checking that the final LLM output contains only tenant‑specific tags and that no cross‑tenant data is referenced. Automated tests can parse the output for tenant identifiers and compare against the expected set.

Mechanisms:

  • SummaryGuardContract enforces tenant tags on the generated text.
  • Soft Diagnose→Model→Build→Harden: Start with lightweight tag audits, then integrate model‑level ACL enforcement, build namespace isolation, and finally harden with immutable audit logs.

Soft Diagnose→Model→Build→Harden

  • Soft Diagnose: Run static analysis on embeddings to detect missing tenant tags.
  • Model: Incorporate ACL checks into the retrieval model’s scoring function.
  • Build: Deploy namespace‑isolated indices and enforce contracts.
  • Harden: Enable immutable audit trails and a kill switch.

Operator Failure Modes

  1. Inadequate pre‑retrieval tenant filtering , Missing tenant tags on embeddings.
  2. Missing tenant tags on vector embeddings , Leads to cross‑tenant retrieval.
  3. Over‑inclusive summary generation , Aggregates cross‑tenant chunks.
  4. Lack of audit logs for ACL violations , Silent leaks.
  5. Failure to propagate tenant context through multi‑hop chains , Re‑introduces filtered data.

Control Model (Named Contracts)

  • TenantAuthContract , Verifies user identity and tenant ID before any query.
  • IndexIsolationContract , Enforces namespace or index separation per tenant.
  • ChunkACLContract , Validates ACL on every chunk before inclusion.
  • SummaryGuardContract , Checks tenant tags on generated summaries.
  • AuditTrailContract , Records every ACL check and any bypass.

Mermaid Flowchart

Loading diagram…

Takeaways

  • ACL checks must be applied at every hop, not just the first.
  • Namespace isolation is the most effective pre‑retrieval defense.
  • Continuous audit trails turn silent leaks into actionable insights.
  • A phased rollout with shadow, limited, and full stages mitigates risk.

FAQ

  1. Can I use a single namespace with ACL tags instead of separate namespaces? Yes, but it requires more complex chunk filtering and increases the risk of leaks if a filter is missed.
  2. What happens if the kill switch is triggered? The system will halt all RAG queries for the affected tenant until the issue is resolved.
  3. How do I measure the performance impact of ACL contracts? Use the eval set to benchmark latency before and after enabling contracts; adjust indexing and caching strategies accordingly.

FAQ

What breaks first after the demo for multi-tenant RAG ACL isolation?
Chunk filters applied once still leak across hops and summaries Treat that as the design constraint before expanding tool access.
Which controls must exist before production traffic?
Scoped tools, durable run identity, evaluation gates, approval policy for irreversible actions, and a kill switch that operators can find without the original author.
How should teams roll this out safely?
Start in shadow or draft mode, score task success, then enable limited writes with human gates, and only then raise autonomy once traces and evals catch regressions.

Related reports