Testing tenant isolation in RAG systems
by Lukas Čeponis, Founder
Most multi-tenant SaaS products enforce isolation in the database. When they add AI features, documents from every customer often land in one vector index.
Where it breaks
Retrieval filters applied in application code, agent memory shared across sessions, and caches keyed without the tenant are the usual paths.
How we test it
We seed two tenants with marker documents and ask each tenant's agent, directly and through injected content, for the other tenant's markers. Every attempt is repeated and reported as a rate.