Tenant isolation for AI retrieval, caches, and background jobs

Follow the document beyond the first query

A document-answering feature has several opportunities to lose its customer boundary: retrieval selects a chunk, a cache retains the answer, a worker processes a delayed job, and an artifact endpoint returns the result. A correct filter in the first database query does not establish that all four paths enforce the same permissions.

OWASP's multitenant guidance treats database, cache, asynchronous work, and storage isolation as related controls. Start with a server-verified identity and authorized membership. A tenant field in a request body, header, model output, or queued message is a selector to validate, not authority to change scope.

The walkthrough below uses fictional Cedar and Maple tenants. It is an original design fixture, not a report of a vulnerability or tests against a service.

Write an authorization matrix with two tenants

Give both synthetic tenants a local document called doc-7. Cedar's permitted paragraph contains CEDAR_ONLY; Maple's contains MAPLE_ONLY. Cedar also has hr-2, unavailable to the ordinary Cedar reader. These harmless markers make a wrong result visible without real customer content.

Record both the permission decision and what reached the downstream model or delivery stub. An assistant saying “access denied” after receiving Maple's paragraph has already crossed this fixture's data boundary.

Authorize the retrieved object before model context

Resolve the permitted tenant from authenticated application state, then authorize the subject, operation, and requested object. Restrict the retrieval query using trusted scope. Preserve owner, document version, and access metadata when documents become chunks; authorize the returned objects before assembling model context.

OWASP's RAG guidance calls for access controls to follow chunks and be enforced at retrieval time. A vector filter can support that enforcement, but its presence alone is not proof: metadata can be missing, stale, incorrectly indexed, or omitted by a different retrieval route.

For the matrix, return the permitted paragraph rather than the full document object, internal notes, or a broad search-result envelope. Denials should not reveal another tenant's document title or contents. Fail closed when authorization cannot be evaluated; do not quietly retry an unscoped search.

Make a cache hit take the authorized path

A cache keyed only by answer:query-digest can collapse identical questions from Cedar and Maple into one result. A tenant prefix fixes that collision but still does not distinguish Cedar's ordinary reader from its restricted-document reviewer.

Define a structured, versioned key from every dimension that changes the authorized answer: environment, tenant, relevant subject or entitlement scope, permission revision, document/index revision, and the answer recipe. Include the normalized query representation where needed. This is a design list, not a ready-to-use key serializer; ambiguous concatenation can create new collisions.

OWASP's cache guidance emphasizes authorization before returning protected cached data and complete key design. Do not put session tokens, credentials, or raw sensitive questions in keys. A digest is not automatically anonymization.

For this fixture, warm Maple's cache first, then ask as Cedar, and reverse the order. Revoke Cedar's document permission after warming its entry and check again. Document invalidation and freshness behavior; a long expiry does not substitute for a current permission decision.

Re-establish authority when a worker wakes up

A user can be permitted when a job is enqueued and revoked before a worker runs it. Carry the job's tenant, initiating subject, intended operation, and target references through an authenticated producer/broker path or integrity-protected job record. At the consumer, re-establish trusted context and authorize the operation against the current rules.

In the deferred-user fixture, removing Cedar membership must stop that delegated user job. A separately authorized service job may have different authority; make that identity and scope explicit rather than pretending an expired user grant is still valid. Do not accept a client-edited tenant field as the worker's credential.

Give retry, deduplication, and result records their correct tenant scope too. Two customers using the same local job identifier must not suppress each other's work or receive each other's completion. Clear per-job context between tasks so a reused worker cannot inherit the previous tenant accidentally.

Treat model-related identifiers as application objects

An uploaded-file identifier, stored model response, generated export, or retrieval conversation may outlive the request that created it. Maintain a trusted mapping from each application object to its tenant, authorized users or service scope, purpose, and retention state. An opaque identifier is not proof of access.

Authorize the lookup and delivery endpoint before fetching or releasing protected contents. Apply the same rule when generating a temporary download link, viewing job status, or retrying an artifact operation. Test the Maple-to-Cedar artifact row directly, including error responses. Keep only the minimal metadata needed in ordinary diagnostics; no raw prompts or document bodies are needed for this fixture.

Turn the matrix into a small review exercise

In your own isolated environment, create fake identities, documents, cache entries, and jobs. Use recording adapters with no external model calls. For each matrix row, predeclare the expected decision, inspect the permitted output, and assert that the other tenant's marker never enters model context or delivery.

Add failure cases for missing tenant context, missing chunk metadata, cache reuse after revocation, and a delayed worker receiving tampered metadata. Check both cold and warm paths. Include successful authorized retrievals so an always-deny system cannot appear useful. These checks are proposed; this article has not run them against your stack or any provider.

The available synthetic CSV exercise and eight local action-policy tests illustrate different controls. They do not test multitenant retrieval, caches, jobs, or model artifacts. Boundary is a prelaunch model router with planned request-path checks; those plans do not automatically enforce the tenant isolation described here. This matrix is a starting point, not proof against every cross-tenant channel.