RAG Security Hardening: Tenant & Role Isolation
A multi-tenant document assistant sends unauthorized chunks into downstream retrieval context.
These results were measured only on 5 controlled authorization queries. They are not client results, live production improvements, or evidence of a formal security audit.
Reproduced root cause
The baseline ranked across every tenant and role, including restricted and deleted documents, before enforcing any authorization.
Focused correction
Use the trusted server-side principal to prefilter by tenant, role and active status; fail closed; ignore client-supplied tenant override; isolate cache keys.
Regression evidence
8 tests: baseline leak; authorization; missing identity; override resistance; revoked roles; deleted chunks; cache separation; untrusted text role.
All listed tests executed and passed on November 12, 2026. Source fixtures, baseline code, corrected code, and test scripts are available in the downloadable project package.
Limits and responsible interpretation
This is an in-memory access-control regression, not a real vector-store test or penetration test. Lower-trust message separation does not prove prompt-injection resistance.