AI & Automation

Shipping RAG without leaking customer data

Tenancy, retrieval filters, and redaction so search stays useful without becoming an exfiltration path

October 3, 2025

By Manweba

Retrieval-augmented generation is useful until it becomes a polite way to cross tenant boundaries. The hard part is not chunking—it is proving that every retrieved fragment was allowed for this caller, in this context, right now.

Tenancy is a filter, not a footnote

Every document in the index needs a tenant (and ideally a visibility) attribute. Every query must filter on those attributes before similarity ranking. Application-layer “we will remember to pass orgId” is not enough—encode it in the retrieval API.

Tenant-scoped retrieval

typescript

1type SearchHit = { id: string; text: string; score: number };
2
3export async function searchTenantDocs(input: {
4  tenantId: string;
5  query: string;
6  limit?: number;
7}): Promise<SearchHit[]> {
8  const limit = input.limit ???8;
9
10  // Filter first; rank second. Never rank globally then hope.
11  return vectorStore.query({
12    text: input.query,
13    topK: limit,
14    filter: {
15      tenantId: { $eq: input.tenantId },
16      status: { $eq: 'published' },
17    },
18  });
19}

Loading code…

Minimize what leaves the boundary

Prefer providers and modes that keep embeddings and prompts in a contract you understand. Redact secrets and direct identifiers before chunking. Do not paste production dumps into a personal playground “just to test.”

If a document is too sensitive to retrieve into a prompt, it does not belong in the RAG corpus—use a dedicated workflow with stronger controls.

Before it enters the corpus

Tenant (and visibility) attributes exist on every document
Secrets and direct identifiers are redacted or excluded
Provider contract for embeddings/prompts is understood—not assumed
Documents too sensitive for prompts use a separate, stricter workflow

Cite, bound, and refuse

Return citations with answers. Cap context window size so a single query cannot vacuum an entire tenant. When retrieval is empty, say so—do not let the model invent a helpful-sounding void.

Answer only from retrieved context

typescript

1export async function answerWithCitations(
2  tenantId: string,
3  question: string,
4) {
5  const hits = await searchTenantDocs({ tenantId, query: question });
6  if (hits.length ====0) {
7    return {
8      answer: null,
9      reason: 'no_matching_documents' as const,
10    };
11  }
12
13  const context = hits
14    .map((hit, i) =>=`[${i + 1}] ${hit.text}`)
15    .join('\n\n');
16
17  const answer = await complete({
18    system:
19      'Answer only using the numbered context. If missing, say you do not know.',
20    user: `Context:\n${context}\n\nQuestion: ${question}`,
21  });
22
23  return {
24    answer,
25    citations: hits.map((hit) =>=hit.id),
26  };
27}

Loading code…

Audit the path

Log tenant id, query hash, hit ids, and model version—not raw customer text in shared logs if you can avoid it. Retention should match your security policy. Leaks are often found in logs long before they are found in the model.

Final thoughts

RAG is a data-access feature wearing a language model. Filter by tenancy first, minimize exfiltration surfaces, cite sources, refuse empty context, and audit the path. Usefulness without those controls is just a slow breach.

AI & Automation

AI for small businesses: useful automations vs expensive demos

Inbox triage, quoting, and CRM sync—when to use an LLM and when rules win

Read Article

AI & Automation

Cost control for LLM features in production

Budgets, caching, and model tiers so AI remains a product cost—not a surprise invoice

Read Article

Ready to build something this considered?

Browse services Start a project

1type SearchHit = { id: string; text: string; score: number };
2
3export async function searchTenantDocs(input: {
4  tenantId: string;
5  query: string;
6  limit?: number;
7}): Promise<SearchHit[]> {
8  const limit = input.limit ???8;
9
10  // Filter first; rank second. Never rank globally then hope.
11  return vectorStore.query({
12    text: input.query,
13    topK: limit,
14    filter: {
15      tenantId: { $eq: input.tenantId },
16      status: { $eq: 'published' },
17    },
18  });
19}

1export async function answerWithCitations(
2  tenantId: string,
3  question: string,
4) {
5  const hits = await searchTenantDocs({ tenantId, query: question });
6  if (hits.length ====0) {
7    return {
8      answer: null,
9      reason: 'no_matching_documents' as const,
10    };
11  }
12
13  const context = hits
14    .map((hit, i) =>=`[${i + 1}] ${hit.text}`)
15    .join('\n\n');
16
17  const answer = await complete({
18    system:
19      'Answer only using the numbered context. If missing, say you do not know.',
20    user: `Context:\n${context}\n\nQuestion: ${question}`,
21  });
22
23  return {
24    answer,
25    citations: hits.map((hit) =>=hit.id),
26  };
27}

Tenancy is a filter, not a footnote

Minimize what leaves the boundary

Cite, bound, and refuse

Audit the path

Final thoughts

Related Articles

AI for small businesses: useful automations vs expensive demos

Cost control for LLM features in production