DANIEL KIRCHNER
All articles
September 4, 20267 min read

Tenant isolation for RAG and agents

RAGMulti-tenantAgentsSecurity

A pilot runs. One index. One prompt. The second customer arrives. Two files now sit in the same room. Without tenant isolation it stays a one-customer pilot.

What has to be isolated

Not only the UI. The retrieval path:

  • a filter or index per tenant
  • no chunks across the boundary, not even "similar"
  • secrets and keys not in a shared repo default
  • agent state that does not carry the other tenant along
  • A shared vector space with hope in metadata filters is the usual finding. The filter is missing once. The answer cites the neighbour.

    Two pictures from practice

    The food-science workspace was multi-tenant from the start. Otherwise it stays a one-team pilot.

    The public-transit platform has 20+ instances. There isolation is operations, not a feature: pipeline and rollback per tenant. The same idea applies to RAG. One index for everyone is the Swarm script for everyone.

    What the check does with it

    Day 4 of the LLM readiness check is operations, cost, tenants. A pilot without isolation is not a go-live for the second customer.

    Related: hybrid RAG, evaluation. Service: AI engineering. For the platform side: Cloud and Kubernetes and the migration assessment.

    Related articles

    Hybrid RAG and reranking instead of naive vector search

    Character-count chunking and vector-only search make hallucinations expected. What hybrid search and reranking change, and what the older RAG article taught wrongly.

    Read article

    LLM hallucinations are a compliance problem

    When a model invents citations, legal stops the project. LLM traceability needs source grounding, not a better prompt.

    Read article

    A call

    30 minutes. If the use case does not belong in production, I'll say so.